Edit tour

Windows Analysis Report
RUN.exe

Overview

General Information

Sample name:	RUN.exe
Analysis ID:	1530965
MD5:	80fb69110342f1a031b10484ea356055
SHA1:	70a77fd61066eaf936feec994301f1c3693c7a28
SHA256:	7c2f43b18bb5f18cb9b8967323a3c68befff6fbf8dceae39f786e8152f493a65
Tags:	exeuser-accbarmailch
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Contains functionality to inject code into remote processes

Creates files in alternative data streams (ADS)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Self deletion via cmd or bat file

Sigma detected: Suspicious Ping/Del Command Combination

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

RUN.exe (PID: 4592 cmdline: "C:\Users\user\Desktop\RUN.exe" MD5: 80FB69110342F1A031B10484EA356055)

RUN.exe (PID: 5320 cmdline: "C:\Users\user\Desktop\RUN.exe" MD5: 80FB69110342F1A031B10484EA356055)

cmd.exe (PID: 2752 cmdline: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\RUN.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 5404 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: 2F46799D79D22AC72C241EC0322B011D)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "109.107.181.162", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "28", "self_destruct": true, "extensions": "none", "links": "none", "grabber_max_size": 1048576}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.2204235009.0000024213155000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: RUN.exe PID: 5320	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: RUN.exe PID: 5320	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Ping/Del Command Combination

Source: Process started

Author: Ilya Krestinichev: Data: Command: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\RUN.exe", CommandLine: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\RUN.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\RUN.exe", ParentImage: C:\Users\user\Desktop\RUN.exe, ParentProcessId: 5320, ParentProcessName: RUN.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\RUN.exe", ProcessId: 2752, ProcessName: cmd.exe

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T18:22:10.339486+0200	2049441	1	A Network Trojan was detected	192.168.2.5	49704	109.107.181.162	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T18:22:10.339486+0200	2050806	1	A Network Trojan was detected	192.168.2.5	49704	109.107.181.162	15666	TCP
2024-10-10T18:22:10.344604+0200	2050806	1	A Network Trojan was detected	192.168.2.5	49704	109.107.181.162	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T18:22:10.339486+0200	2050807	1	A Network Trojan was detected	192.168.2.5	49704	109.107.181.162	15666	TCP
2024-10-10T18:22:10.344604+0200	2050807	1	A Network Trojan was detected	192.168.2.5	49704	109.107.181.162	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\a.exe:extractor.dll

Avira: detection malicious, Label: HEUR/AGEN.1354117

Found malware configuration

Source: 1.2.RUN.exe.140000000.0.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "109.107.181.162", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "28", "self_destruct": true, "extensions": "none", "links": "none", "grabber_max_size": 1048576}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Desktop\a.exe:extractor.dll

ReversingLabs: Detection: 41%

Multi AV Scanner detection for submitted file

Source: RUN.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\a.exe:extractor.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: RUN.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140070410 CryptUnprotectData,LocalFree,		1_2_0000000140070410
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140035BD0 CryptUnprotectData,LocalFree,		1_2_0000000140035BD0

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: RUN.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400B93CC FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,	1_2_00000001400B93CC
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400B947C GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,GetLastError,GetFileAttributesW,__std_fs_open_handle,CloseHandle,	1_2_00000001400B947C
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140034D60 FindFirstFileW,FindNextFileW,	1_2_0000000140034D60
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400D40D8 FindFirstFileW,FindNextFileW,	1_2_00000001400D40D8

Source: C:\Users\user\Desktop\RUN.exe

Code function: 1_2_0000000140088D70 GetLogicalDriveStringsW,

1_2_0000000140088D70

Source: C:\Users\user\Desktop\RUN.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then sub rsp, 28h	0_2_00007FF66B15DC50
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rsi	0_2_00007FF66B159CD0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rdi	0_2_00007FF66B15ACD0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rdi	0_2_00007FF66B15ACD0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rdi	0_2_00007FF66B15ACD0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rsi	0_2_00007FF66B151D20
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then cmp rdx, 01h	0_2_00007FF66B14FBE0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rsi	0_2_00007FF66B1520B0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rbx	0_2_00007FF66B13AF33
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then sub rsp, 28h	0_2_00007FF66B15DD49
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rbp	0_2_00007FF66B14AE30
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rbp	0_2_00007FF66B14B470
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push r15	0_2_00007FF66B14929E
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rdi	0_2_00007FF66B15A1B0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rdi	0_2_00007FF66B15A1B0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rdi	0_2_00007FF66B15A1B0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rbx	0_2_00007FF66B15B8C0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then sub rsp, 28h	1_2_00007FF66B15DC50
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rsi	1_2_00007FF66B159CD0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rdi	1_2_00007FF66B15ACD0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rdi	1_2_00007FF66B15ACD0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rdi	1_2_00007FF66B15ACD0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rsi	1_2_00007FF66B151D20
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then cmp rdx, 01h	1_2_00007FF66B14FBE0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rsi	1_2_00007FF66B1520B0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rbx	1_2_00007FF66B13AF33
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then sub rsp, 28h	1_2_00007FF66B15DD49
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rbp	1_2_00007FF66B14AE30
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rbp	1_2_00007FF66B14B470
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push r15	1_2_00007FF66B14929E
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rdi	1_2_00007FF66B15A1B0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rdi	1_2_00007FF66B15A1B0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rdi	1_2_00007FF66B15A1B0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 4x nop then push rbx	1_2_00007FF66B15B8C0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.5:49704 -> 109.107.181.162:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.5:49704 -> 109.107.181.162:15666
Source: Network traffic	Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.5:49704 -> 109.107.181.162:15666

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 109.107.181.162:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205

Source: Joe Sandbox View

ASN Name: TELEPORT-TV-ASRU TELEPORT-TV-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.181.162

Source: C:\Users\user\Desktop\RUN.exe

Code function: 1_2_0000000140070830 Concurrency::cancel_current_task,InternetOpenW,InternetOpenUrlA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

1_2_0000000140070830

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: RUN.exe, 00000001.00000002.2204235009.0000024213203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: RUN.exe, 00000001.00000003.2202423492.00000242158E0000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2202472603.00000242158E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi
Source: RUN.exe, 00000001.00000003.2036391573.00000242158D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi)F
Source: RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2040061170.00000242131D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RUN.exe, 00000001.00000002.2204235009.0000024213155000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000002.2204235009.0000024213137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RUN.exe, 00000001.00000003.2066148254.00000242131DB000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D3000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: RUN.exe, 00000001.00000003.2066148254.00000242131DB000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D3000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2040061170.00000242131D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2040061170.00000242131D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2040061170.00000242131D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RUN.exe, 00000001.00000003.2066148254.00000242131DB000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D3000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: RUN.exe, 00000001.00000003.2066148254.00000242131DB000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D3000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038501883.0000024215C1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2039601750.0000024215C1F000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038501883.0000024215C1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038501883.0000024215C1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RUN.exe	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: RUN.exe, 00000001.00000003.2066036652.00000242131D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: RUN.exe, 00000001.00000003.2061516063.0000024215FA8000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2059602201.0000024215D4F000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2057905457.0000024214F38000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2059856665.0000024214F30000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2059602201.0000024215D47000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2058084500.0000024215D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: RUN.exe, 00000001.00000003.2059602201.0000024215D57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: RUN.exe, 00000001.00000003.2059602201.0000024215D57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: RUN.exe, 00000001.00000003.2066148254.00000242131DB000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D3000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: RUN.exe, 00000001.00000003.2066148254.00000242131DB000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D3000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2040061170.00000242131D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RUN.exe, 00000001.00000003.2061516063.0000024215FA8000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2059602201.0000024215D4F000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2057905457.0000024214F38000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2059856665.0000024214F30000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2059602201.0000024215D47000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2058084500.0000024215D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: RUN.exe, 00000001.00000003.2059602201.0000024215D57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: RUN.exe, 00000001.00000003.2059602201.0000024215D57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: RUN.exe, 00000001.00000003.2057905457.0000024214F3F000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2061516063.0000024215FAF000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2059602201.0000024215D57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: RUN.exe, 00000001.00000003.2059602201.0000024215D57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RUN.exe, 00000001.00000003.2057905457.0000024214F3F000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2061516063.0000024215FAF000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2059602201.0000024215D57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: RUN.exe, 00000001.00000003.2057905457.0000024214F3F000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2061516063.0000024215FAF000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2059602201.0000024215D57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B1216A0 memcpy,strlen,strcpy_s,WideCharToMultiByte,strcpy_s,strcpy_s,strcpy_s,_strlwr,_strlwr,strstr,strcmp,CreateFileA,WideCharToMultiByte,strcpy_s,strcpy_s,strcpy_s,_strlwr,_strlwr,strstr,strcmp,NtWriteFile,WideCharToMultiByte,_strlwr,_strlwr,strstr,strcmp,NtClose,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,LdrLoadDll,strcmp,WideCharToMultiByte,_strlwr,_strlwr,strstr,strcmp,WideCharToMultiByte,_strlwr,_strlwr,strstr,strcmp,NtProtectVirtualMemory,remove,FreeLibrary,free,memcpy,WideCharToMultiByte,_strlwr,_strlwr,strstr,strcmp,strcmp,NtProtectVirtualMemory,strcmp,NtProtectVirtualMemory,strcmp,NtProtectVirtualMemory,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,exit,	0_2_00007FF66B1216A0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B123590 strcmp,strcmp,NtQueryInformationProcess,	0_2_00007FF66B123590
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B1225D1 strcmp,NtProtectVirtualMemory,strcmp,NtProtectVirtualMemory,strcmp,NtProtectVirtualMemory,strcmp,strcmp,	0_2_00007FF66B1225D1
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400D46C0 NtQuerySystemInformation,	1_2_00000001400D46C0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014008B700 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	1_2_000000014008B700

Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B1216A0	0_2_00007FF66B1216A0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B143CF0	0_2_00007FF66B143CF0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B156C30	0_2_00007FF66B156C30
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B13FB30	0_2_00007FF66B13FB30
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B135F60	0_2_00007FF66B135F60
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B126E80	0_2_00007FF66B126E80
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B15BD80	0_2_00007FF66B15BD80
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B14B470	0_2_00007FF66B14B470
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B13E450	0_2_00007FF66B13E450
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B1237A0	0_2_00007FF66B1237A0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B1276D0	0_2_00007FF66B1276D0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B142710	0_2_00007FF66B142710
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B14D5F0	0_2_00007FF66B14D5F0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B1295D0	0_2_00007FF66B1295D0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF8A8E12CF0	0_2_00007FF8A8E12CF0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF8A8E03C10	0_2_00007FF8A8E03C10
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF8A8E1AED0	0_2_00007FF8A8E1AED0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF8A8E200BA	0_2_00007FF8A8E200BA
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF8A8E1F190	0_2_00007FF8A8E1F190
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF8A8E06360	0_2_00007FF8A8E06360
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF8A8E04460	0_2_00007FF8A8E04460
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF8A8E1C5B0	0_2_00007FF8A8E1C5B0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF8A8E20750	0_2_00007FF8A8E20750
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140042000	1_2_0000000140042000
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014003787D	1_2_000000014003787D
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014005A150	1_2_000000014005A150
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140080220	1_2_0000000140080220
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140080A20	1_2_0000000140080A20
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014005FB20	1_2_000000014005FB20
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014003CC00	1_2_000000014003CC00
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014002F420	1_2_000000014002F420
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400B947C	1_2_00000001400B947C
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014003B4B0	1_2_000000014003B4B0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400A44E8	1_2_00000001400A44E8
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140031D30	1_2_0000000140031D30
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014002ED30	1_2_000000014002ED30
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140034D60	1_2_0000000140034D60
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014005ED70	1_2_000000014005ED70
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140081600	1_2_0000000140081600
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014008FED0	1_2_000000014008FED0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140081FA0	1_2_0000000140081FA0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014005C7C0	1_2_000000014005C7C0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014006B860	1_2_000000014006B860
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140067880	1_2_0000000140067880
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014006E0E0	1_2_000000014006E0E0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400158E0	1_2_00000001400158E0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400070E0	1_2_00000001400070E0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140063140	1_2_0000000140063140
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400BC170	1_2_00000001400BC170
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140053180	1_2_0000000140053180
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140006180	1_2_0000000140006180
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014006E9BA	1_2_000000014006E9BA
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014006C1D0	1_2_000000014006C1D0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400561E0	1_2_00000001400561E0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400BE9F0	1_2_00000001400BE9F0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140028200	1_2_0000000140028200
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014006B230	1_2_000000014006B230
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014002FA50	1_2_000000014002FA50
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014006DAB0	1_2_000000014006DAB0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014009FAF8	1_2_000000014009FAF8
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140026340	1_2_0000000140026340
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140025350	1_2_0000000140025350
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014006BB80	1_2_000000014006BB80
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014004C3A0	1_2_000000014004C3A0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400A63BC	1_2_00000001400A63BC
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014004ABD0	1_2_000000014004ABD0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014006E520	1_2_000000014006E520
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140006D20	1_2_0000000140006D20
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014006B530	1_2_000000014006B530
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140059550	1_2_0000000140059550
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014008F5A0	1_2_000000014008F5A0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140005DB0	1_2_0000000140005DB0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140006610	1_2_0000000140006610
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140035E20	1_2_0000000140035E20
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014002FE96	1_2_000000014002FE96
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014006BEA0	1_2_000000014006BEA0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_000000014004DEA0	1_2_000000014004DEA0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00007FF66B143CF0	1_2_00007FF66B143CF0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00007FF66B156C30	1_2_00007FF66B156C30
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00007FF66B13FB30	1_2_00007FF66B13FB30
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00007FF66B135F60	1_2_00007FF66B135F60
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00007FF66B126E80	1_2_00007FF66B126E80
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00007FF66B15BD80	1_2_00007FF66B15BD80
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00007FF66B14B470	1_2_00007FF66B14B470
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00007FF66B13E450	1_2_00007FF66B13E450
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00007FF66B1237A0	1_2_00007FF66B1237A0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00007FF66B1216A0	1_2_00007FF66B1216A0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00007FF66B1276D0	1_2_00007FF66B1276D0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00007FF66B142710	1_2_00007FF66B142710
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00007FF66B14D5F0	1_2_00007FF66B14D5F0
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00007FF66B1295D0	1_2_00007FF66B1295D0

Source: C:\Users\user\Desktop\RUN.exe	Code function: String function: 000000014002FE70 appears 34 times
Source: C:\Users\user\Desktop\RUN.exe	Code function: String function: 00000001400348F0 appears 41 times
Source: C:\Users\user\Desktop\RUN.exe	Code function: String function: 00007FF66B15D580 appears 84 times
Source: C:\Users\user\Desktop\RUN.exe	Code function: String function: 00007FF66B15BC90 appears 52 times
Source: C:\Users\user\Desktop\RUN.exe	Code function: String function: 00007FF66B15D670 appears 376 times
Source: C:\Users\user\Desktop\RUN.exe	Code function: String function: 00007FF66B15D710 appears 168 times

Source: a.exe_extractor.dll.0.dr

Static PE information: Number of sections : 11 > 10

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/2@1/2

Source: C:\Users\user\Desktop\RUN.exe

Code function: 1_2_000000014003B4B0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

1_2_000000014003B4B0

Source: C:\Users\user\Desktop\RUN.exe

Code function: 1_2_000000014006DAB0 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,SysAllocStringByteLen,SysFreeString,SysAllocStringByteLen,SysFreeString,SysStringByteLen,SysFreeString,SysFreeString,SysStringByteLen,SysFreeString,SysFreeString,

1_2_000000014006DAB0

Source: C:\Users\user\Desktop\RUN.exe

File created: C:\Users\user\Desktop\a.exe:extractor.dll

Jump to behavior

Source: C:\Users\user\Desktop\RUN.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E69638AD8C25F
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7088:120:WilError_03

Source: RUN.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RUN.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RUN.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RUN.exe

ReversingLabs: Detection: 65%

Source: RUN.exe	String found in binary or memory: --help
Source: RUN.exe	String found in binary or memory: --help

Source: unknown	Process created: C:\Users\user\Desktop\RUN.exe "C:\Users\user\Desktop\RUN.exe"
Source: C:\Users\user\Desktop\RUN.exe	Process created: C:\Users\user\Desktop\RUN.exe "C:\Users\user\Desktop\RUN.exe"
Source: C:\Users\user\Desktop\RUN.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\RUN.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\Desktop\RUN.exe	Process created: C:\Users\user\Desktop\RUN.exe "C:\Users\user\Desktop\RUN.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\RUN.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000	Jump to behavior

Source: C:\Users\user\Desktop\RUN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: a.exe:extractor.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\Desktop\RUN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\RUN.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: RUN.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: RUN.exe

Static file information: File size 1549312 > 1048576

Source: RUN.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x136400

Source: RUN.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\RUN.exe

Code function: 0_2_00007FF66B1216A0 memcpy,strlen,strcpy_s,WideCharToMultiByte,strcpy_s,strcpy_s,strcpy_s,_strlwr,_strlwr,strstr,strcmp,CreateFileA,WideCharToMultiByte,strcpy_s,strcpy_s,strcpy_s,_strlwr,_strlwr,strstr,strcmp,NtWriteFile,WideCharToMultiByte,_strlwr,_strlwr,strstr,strcmp,NtClose,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,LdrLoadDll,strcmp,WideCharToMultiByte,_strlwr,_strlwr,strstr,strcmp,WideCharToMultiByte,_strlwr,_strlwr,strstr,strcmp,NtProtectVirtualMemory,remove,FreeLibrary,free,memcpy,WideCharToMultiByte,_strlwr,_strlwr,strstr,strcmp,strcmp,NtProtectVirtualMemory,strcmp,NtProtectVirtualMemory,strcmp,NtProtectVirtualMemory,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,exit,

0_2_00007FF66B1216A0

Source: RUN.exe	Static PE information: section name: .xdata
Source: a.exe_extractor.dll.0.dr	Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\RUN.exe

Code function: 0_2_00007FF66B2991B0 push 01130064h; iretd

0_2_00007FF66B2991BA

Source: C:\Users\user\Desktop\RUN.exe

File created: C:\Users\user\Desktop\a.exe:extractor.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Creates files in alternative data streams (ADS)

Source: C:\Users\user\Desktop\RUN.exe

File created: C:\Users\user\Desktop\a.exe:extractor.dll

Jump to behavior

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\RUN.exe	Process created: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\RUN.exe"
Source: C:\Users\user\Desktop\RUN.exe	Process created: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\RUN.exe"			Jump to behavior

Source: C:\Users\user\Desktop\RUN.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000			Jump to behavior

Source: C:\Users\user\Desktop\RUN.exe	API coverage: 7.7 %
Source: C:\Users\user\Desktop\RUN.exe	API coverage: 4.3 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400B93CC FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,	1_2_00000001400B93CC
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400B947C GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,GetLastError,GetFileAttributesW,__std_fs_open_handle,CloseHandle,	1_2_00000001400B947C
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140034D60 FindFirstFileW,FindNextFileW,	1_2_0000000140034D60
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400D40D8 FindFirstFileW,FindNextFileW,	1_2_00000001400D40D8

Source: C:\Users\user\Desktop\RUN.exe

Code function: 1_2_0000000140088D70 GetLogicalDriveStringsW,

1_2_0000000140088D70

Source: C:\Users\user\Desktop\RUN.exe

Code function: 1_2_00000001400D4118 CloseHandle,GetSystemInfo,ReleaseMutex,OpenMutexA,GetModuleFileNameA,SetHandleInformation,

1_2_00000001400D4118

Source: C:\Users\user\Desktop\RUN.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RUN.exe, 00000001.00000002.2204235009.00000242131D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: RUN.exe, 00000001.00000002.2204235009.00000242131B4000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000002.2204235009.0000024213155000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2037368275.00000242131CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RUN.exe, 00000001.00000003.2050865815.0000024215C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\RUN.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\RUN.exe

0_2_00007FF66B1216A0

Source: C:\Users\user\Desktop\RUN.exe

Code function: 1_2_00000001400BB8D4 GetLastError,IsDebuggerPresent,OutputDebugStringW,

1_2_00000001400BB8D4

Source: C:\Users\user\Desktop\RUN.exe

Code function: 1_2_00000001400BB8D4 GetLastError,IsDebuggerPresent,OutputDebugStringW,

1_2_00000001400BB8D4

Source: C:\Users\user\Desktop\RUN.exe

0_2_00007FF66B1216A0

Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B121180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,GetStartupInfoA,	0_2_00007FF66B121180
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B29D3B8 SetUnhandledExceptionFilter,	0_2_00007FF66B29D3B8
Source: C:\Users\user\Desktop\RUN.exe	Code function: 0_2_00007FF66B14365A SetUnhandledExceptionFilter,	0_2_00007FF66B14365A
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_0000000140096A38 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0000000140096A38
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00000001400D42B8 SetUnhandledExceptionFilter,	1_2_00000001400D42B8
Source: C:\Users\user\Desktop\RUN.exe	Code function: 1_2_00007FF66B121180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,GetStartupInfoA,	1_2_00007FF66B121180

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\RUN.exe

Code function: 0_2_00007FF8A8E01690 LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleFileNameA,CreateProcessA,FreeLibrary,FreeLibrary,FreeLibrary,VirtualAlloc,GetThreadContext,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,WaitForSingleObject,

0_2_00007FF8A8E01690

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\RUN.exe

Memory written: C:\Users\user\Desktop\RUN.exe base: 140000000 value starts with: 4D5A

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\RUN.exe

Thread register set: target process: 5320

Jump to behavior

Source: C:\Users\user\Desktop\RUN.exe	Process created: C:\Users\user\Desktop\RUN.exe "C:\Users\user\Desktop\RUN.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\RUN.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000	Jump to behavior

Source: C:\Users\user\Desktop\RUN.exe

Code function: 0_2_00007FF66B124B40 cpuid

0_2_00007FF66B124B40

Source: C:\Users\user\Desktop\RUN.exe	Code function: GetLocaleInfoW,	1_2_00000001400A3090
Source: C:\Users\user\Desktop\RUN.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_00000001400AE120
Source: C:\Users\user\Desktop\RUN.exe	Code function: EnumSystemLocalesW,	1_2_00000001400ADA38
Source: C:\Users\user\Desktop\RUN.exe	Code function: EnumSystemLocalesW,	1_2_00000001400ADB08
Source: C:\Users\user\Desktop\RUN.exe	Code function: EnumSystemLocalesW,	1_2_00000001400A2B4C
Source: C:\Users\user\Desktop\RUN.exe	Code function: GetLocaleInfoW,	1_2_00000001400D43A0
Source: C:\Users\user\Desktop\RUN.exe	Code function: EnumSystemLocalesW,	1_2_00000001400D43B8
Source: C:\Users\user\Desktop\RUN.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	1_2_00000001400AD6EC
Source: C:\Users\user\Desktop\RUN.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_00000001400ADF44
Source: C:\Users\user\Desktop\RUN.exe	Code function: GetLocaleInfoEx,FormatMessageA,	1_2_00000001400B8FC4

Source: C:\Users\user\Desktop\RUN.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\RUN.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\RUN.exe

Code function: 1_2_00000001400B40E8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00000001400B40E8

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: RUN.exe PID: 5320, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 00000001.00000002.2204235009.0000024213155000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RUN.exe PID: 5320, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RUN.exe, 00000001.00000002.2204235009.0000024213155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum-LTC\wallets
Source: RUN.exe, 00000001.00000002.2204235009.0000024213155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\wallets
Source: RUN.exe, 00000001.00000003.2088276894.0000024217B26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "software": "Ny1aaXAgMjMuMDEgKHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzMl0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNDddCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K",
Source: RUN.exe, 00000001.00000002.2204235009.0000024213155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: RUN.exe, 00000001.00000002.2204235009.0000024213155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: RUN.exe, 00000001.00000002.2204235009.0000024213155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\RUN.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\RUN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\RUN.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: RUN.exe PID: 5320, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 00000001.00000002.2204235009.0000024213155000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RUN.exe PID: 5320, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	11 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	311 Process Injection	3 Obfuscated Files or Information	LSASS Memory	4 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	34 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	121 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	2 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	311 Process Injection	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 NTFS File Attributes	DCSync	11 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RUN.exe	66%	ReversingLabs	Win64.Spyware.Meduzastealer
RUN.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Desktop\a.exe:extractor.dll	100%	Avira	HEUR/AGEN.1354117
C:\Users\user\Desktop\a.exe:extractor.dll	100%	Joe Sandbox ML
C:\Users\user\Desktop\a.exe:extractor.dll	42%	ReversingLabs	Win64.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://gcc.gnu.org/bugs/):	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2040061170.00000242131D9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2039601750.0000024215C1F000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038501883.0000024215C1E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gcc.gnu.org/bugs/):	RUN.exe	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038501883.0000024215C1E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	RUN.exe, 00000001.00000003.2066148254.00000242131DB000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D3000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	RUN.exe, 00000001.00000003.2066148254.00000242131DB000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D3000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2040061170.00000242131D9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	RUN.exe, 00000001.00000003.2066036652.00000242131D7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	RUN.exe, 00000001.00000003.2059602201.0000024215D57000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	RUN.exe, 00000001.00000003.2066148254.00000242131DB000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D3000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	RUN.exe, 00000001.00000003.2066148254.00000242131DB000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D3000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038501883.0000024215C1E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	RUN.exe, 00000001.00000003.2066148254.00000242131DB000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D3000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.microsoft.t/Regi)F	RUN.exe, 00000001.00000003.2036391573.00000242158D1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2040061170.00000242131D9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org	RUN.exe, 00000001.00000003.2061516063.0000024215FA8000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2059602201.0000024215D4F000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2057905457.0000024214F38000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2059856665.0000024214F30000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2059602201.0000024215D47000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2058084500.0000024215D12000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2040061170.00000242131D9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ns.microsoft.t/Regi	RUN.exe, 00000001.00000003.2202423492.00000242158E0000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2202472603.00000242158E4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	RUN.exe, 00000001.00000003.2066148254.00000242131DB000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D3000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2066036652.00000242131D7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RUN.exe, 00000001.00000003.2038501883.0000024215C37000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2038891640.00000242131D5000.00000004.00000020.00020000.00000000.sdmp, RUN.exe, 00000001.00000003.2040061170.00000242131D9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	RUN.exe, 00000001.00000003.2059602201.0000024215D57000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.micros	RUN.exe, 00000001.00000002.2204235009.0000024213203000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
109.107.181.162	unknown	Russian Federation		49973	TELEPORT-TV-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1530965
Start date and time:	2024-10-10 18:21:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RUN.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/2@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 67% Number of executed functions: 53 Number of non-executed functions: 133
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, crl3.digicert.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: RUN.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
109.107.181.162	App_installer32_64x.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	setup_run.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	installer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	Oldsetup.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	https://linkpage.bio/verifybusinessaccount1368	Get hash	malicious	Unknown	Browse	172.67.74.152
	YyhAkj09dy.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	104.26.12.205
	ZfzNdscQNj.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	perfcc.elf	Get hash	malicious	Xmrig	Browse	104.26.12.205
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	104.26.12.205
	Documents.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	Untitled.eml	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Fw_ Complete with Docusign_ J929272_SOW Extension_002_09-OCT-24_201415.pdf.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://na2.docusign.net/Signing/EmailStart.aspx?a=65ce31e3-0f62-43e8-8a06-1efc3ff79e46&etti=24&acct=f03a97ef-a21a-4b5f-a673-fe222edf542a&er=c4396d2f-541c-4d1d-bd82-7b6b044f29c3	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	original.eml	Get hash	malicious	Unknown	Browse	104.18.65.57
	ASmartCore_[1MB]_[unsign].exe	Get hash	malicious	LummaC	Browse	104.21.46.170
	Play_Now-(Sonaemc)MOPT.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://media.thesocialpresskit.com/american-bankers-association/BNAT2024PrintablesPostcard2.zip	Get hash	malicious	Unknown	Browse	162.159.61.3
TELEPORT-TV-ASRU	App_installer32_64x.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.162
	setup_run.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.162
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.162
	wqOq2pxuQB.exe	Get hash	malicious	Stealc, Vidar	Browse	109.107.187.5
	Wv3pZF5jI3.exe	Get hash	malicious	RedLine	Browse	109.107.182.39
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	109.107.161.150
	clik.exe	Get hash	malicious	CredGrabber, PureLog Stealer	Browse	109.107.181.83
	leadiadequatepro.exe	Get hash	malicious	CredGrabber, PureLog Stealer	Browse	109.107.181.83
	responsibilityleadpro.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.83
	CE1KVxYp5t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.83

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	installer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	Oldsetup.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	FMAudit.Installer_9652_1238001249.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Impressionist.exe	Get hash	malicious	GuLoader	Browse	104.26.12.205
	PAGO.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.26.12.205
	UMOWA_09.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.26.12.205
	UMOWA_09.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.26.12.205
	MFSA-MiFID-APS-P2_20241007-Annex2_DOC-R-v1.1.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	MFSA-MiFID-APS-P2_20241003_ Submission Requirements.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	ADSP-21593BBPZ10 Analog Devices, Inc. 5000.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	104.26.12.205

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\Desktop\a.exe:extractor.dll

Download File

Process:	C:\Users\user\Desktop\RUN.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1246720
Entropy (8bit):	7.387585508857993
Encrypted:	false
SSDEEP:	24576:btYuDxnwgAJNpS3m/Oio5exC2B+dXSez3ZnzP8/brYkp6jH6BQQFS:btYYxnw5WiqexC/CmpzP8TrD6LSQ8S
MD5:	C28352A57EDBEEFD21AAA2D0E435C8BC
SHA1:	40B3A04DE7A16A5CF46418776A02F452BC4E97D2
SHA-256:	D104CFA64890074D2921F29E164D6D16576B540217597EA961FF668F1F901AA4
SHA-512:	A4F7F32206BD2A46D7F7FE5B8035E41E10AF68FDBB712916464A1D6073C2B308B8A7C449369B0197A28C47066F02C4F164FC6444B9044077B13D62D93A462B50
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...&X.f..........."...)............`.........'..............................p......b.....`... ...................................... .......0...............................`..............................@...(...................@2...............................text...............................`..`.data........0......................@....rdata...........0..................@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata....... ......................@..@.idata.......0......................@....CRT....X....@......................@....tls.........P......................@....reloc.......`......................@..B........................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	275
Entropy (8bit):	4.825671547285939
Encrypted:	false
SSDEEP:	6:PzXULmWxHLTpUrS/PaGbsW3CNcwAFeMmvVOIHJFxMVlmJHaVF6Sb6et2:P+pTpcOaGbsTDAFSkIrxMVlmJHaVG
MD5:	641296DA83CC331C68F284455BBFEBF8
SHA1:	A80B039410356B5154E077F4777B855D97D5BED7
SHA-256:	DF538CBB7A4C10509D7942ABC5DF083E6A03B021AA74FBAC1290B450D7815B52
SHA-512:	703BD4842D28E5A5151CF55F46AA105DE7D3B840E9CCDE6748D472521BA3023331049BB926A494C40415B08CE2C0C125515C1B21F52B3D16DA48EE2092806475
Malicious:	false
Reputation:	low
Preview:	..Pinging 1.1.1.1 with 32 bytes of data:..Reply from 1.1.1.1: bytes=32 time=7ms TTL=51....Ping statistics for 1.1.1.1:.. Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 7ms, Maximum = 7ms, Average = 7ms..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.700688005463953
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	RUN.exe
File size:	1'549'312 bytes
MD5:	80fb69110342f1a031b10484ea356055
SHA1:	70a77fd61066eaf936feec994301f1c3693c7a28
SHA256:	7c2f43b18bb5f18cb9b8967323a3c68befff6fbf8dceae39f786e8152f493a65
SHA512:	bfacbb61f1c68e0b4e5d7a249512f839933377acb0070d865d202947e948a7e74f84cc55618adfb34a205f8de466ee43962f087aaa27beac5d09f57497783d23
SSDEEP:	24576:K9hSDFEfJ3HW802gQzSMZs8A+xoZYqPLYnNBa1ndKFyzqxVAPI4WTG+G0lzOp91v:K9hMFEfVHW802gQmMZs8A+uX0nNBvFy5
TLSH:	FD65F10B57972AFCC267E03493CA9F7A6E70F81E1B107C1645E0DEB30E35D24DA6526A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...<X.f...............).......................@..........................................`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x1400014a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x66F5583C [Thu Sep 26 12:49:00 2024 UTC]
TLS Callbacks:	0x4001a7c0, 0x1, 0x4001a790, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	bd57c285d6a5e2a5490823348902be43

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00172555h]
mov dword ptr [eax], 00000001h
call 00007F01490E75EFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00172535h]
mov dword ptr [eax], 00000000h
call 00007F01490E75CFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F0149109954h
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F01490E78F9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
mov ecx, dword ptr [0017AB19h]
dec eax
test ecx, ecx
je 00007F01490E7936h
mov edx, 00000001h
jmp 00007F014912317Fh
nop word ptr [eax+eax+00000000h]
ret
nop
nop word ptr [eax+eax+00000000h]
nop dword ptr [eax]
inc ecx
push edi
inc ecx
push esi
inc ecx
push ebp
inc ecx
push esp
push ebp
push edi
push esi
push ebx
dec eax
sub esp, 00000498h
dec eax
mov eax, dword ptr [00000000h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17d000	0xbb0	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x176000	0x2634	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x180000	0x450	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x173040	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x17d2e8	0x2a8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3ce18	0x3d000	6e3207b6e738c849357d5cc5eadff8f5	False	0.3964203381147541	DIY-Thermocam raw data (Lepton 2.x), scale -5159-26214, spot sensor temperature -0.000000, unit celsius, color scheme 0, calibration: offset 8.007583, slope 13.390952	6.121933916474792	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3e000	0x230	0x400	54c30bd056bad3a2a28d7d4e5d30c026	False	0.1123046875	data	0.9014923988224003	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x3f000	0x136240	0x136400	c4e8387490b00edbfe5e55bc0eea5211	False	0.7592021932917002	data	7.8041323006894245	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x176000	0x2634	0x2800	3d077addb5b9a56e335cae2add5f2ca8	False	0.49375	data	5.445951049867053	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x179000	0x2984	0x2a00	82c16b01093b8ab3fc164d6e79cda362	False	0.17587425595238096	data	4.481152417575644	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x17c000	0xbd0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x17d000	0xbb0	0xc00	95bb611cbd1c7694140dd24d8126f798	False	0.3375651041666667	data	4.315543083234784	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x17e000	0x60	0x200	fd16bfa12c0ef660ea7cd3b9d9add3cb	False	0.068359375	data	0.3124937745953951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x17f000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x180000	0x450	0x600	edb4e248f94038a54b345b54a71fc33c	False	0.490234375	data	4.576743614039055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

CloseHandle, DeleteCriticalSection, EnterCriticalSection, FormatMessageA, FreeLibrary, GetCurrentProcess, GetExitCodeProcess, GetLastError, GetModuleHandleW, GetProcAddress, GetStartupInfoA, GetThreadId, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryW, LocalFree, MultiByteToWideChar, Process32First, Process32Next, RaiseException, RtlCaptureContext, RtlLookupFunctionEntry, RtlUnwindEx, RtlVirtualUnwind, SetLastError, SetUnhandledExceptionFilter, Sleep, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualProtect, VirtualQuery, WideCharToMultiByte

msvcrt.dll

__C_specific_handler, ___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _commode, _errno, _fmode, _initterm, _onexit, _strlwr, abort, calloc, exit, fprintf, fputc, fputs, free, fwrite, getenv, localeconv, malloc, memchr, memcmp, memcpy, memmove, memset, realloc, remove, signal, strchr, strcmp, strcpy_s, strerror, strlen, strncmp, strstr, strtoul, vfprintf, wcslen, _read

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-10T18:22:10.339486+0200	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.5	49704	109.107.181.162	15666	TCP
2024-10-10T18:22:10.339486+0200	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.5	49704	109.107.181.162	15666	TCP
2024-10-10T18:22:10.339486+0200	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.5	49704	109.107.181.162	15666	TCP
2024-10-10T18:22:10.344604+0200	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.5	49704	109.107.181.162	15666	TCP
2024-10-10T18:22:10.344604+0200	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.5	49704	109.107.181.162	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2024 18:22:04.006830931 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:04.011785030 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:04.014142990 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:04.088305950 CEST	49705	443	192.168.2.5	104.26.12.205
Oct 10, 2024 18:22:04.088334084 CEST	443	49705	104.26.12.205	192.168.2.5
Oct 10, 2024 18:22:04.088406086 CEST	49705	443	192.168.2.5	104.26.12.205
Oct 10, 2024 18:22:04.101130962 CEST	49705	443	192.168.2.5	104.26.12.205
Oct 10, 2024 18:22:04.101144075 CEST	443	49705	104.26.12.205	192.168.2.5
Oct 10, 2024 18:22:04.629988909 CEST	443	49705	104.26.12.205	192.168.2.5
Oct 10, 2024 18:22:04.630103111 CEST	49705	443	192.168.2.5	104.26.12.205
Oct 10, 2024 18:22:04.694544077 CEST	49705	443	192.168.2.5	104.26.12.205
Oct 10, 2024 18:22:04.694605112 CEST	443	49705	104.26.12.205	192.168.2.5
Oct 10, 2024 18:22:04.695600033 CEST	443	49705	104.26.12.205	192.168.2.5
Oct 10, 2024 18:22:04.695683002 CEST	49705	443	192.168.2.5	104.26.12.205
Oct 10, 2024 18:22:04.696984053 CEST	49705	443	192.168.2.5	104.26.12.205
Oct 10, 2024 18:22:04.743402004 CEST	443	49705	104.26.12.205	192.168.2.5
Oct 10, 2024 18:22:04.839658022 CEST	443	49705	104.26.12.205	192.168.2.5
Oct 10, 2024 18:22:04.839720964 CEST	443	49705	104.26.12.205	192.168.2.5
Oct 10, 2024 18:22:04.839742899 CEST	49705	443	192.168.2.5	104.26.12.205
Oct 10, 2024 18:22:04.839790106 CEST	49705	443	192.168.2.5	104.26.12.205
Oct 10, 2024 18:22:04.840054035 CEST	49705	443	192.168.2.5	104.26.12.205
Oct 10, 2024 18:22:04.840068102 CEST	443	49705	104.26.12.205	192.168.2.5
Oct 10, 2024 18:22:10.339485884 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.344427109 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.344533920 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.344566107 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.344579935 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.344592094 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.344604015 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.344618082 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.344630957 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.344636917 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.344645023 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.344655991 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.344660044 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.344671965 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.344717026 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.345674992 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.345730066 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.349544048 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.349591970 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.349606991 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.349611998 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.349612951 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.349648952 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.349663973 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.349664927 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.349704027 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.349735022 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.349849939 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.349917889 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.350097895 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.350151062 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.354635000 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.354702950 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.354825974 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.354881048 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.354964018 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.355019093 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.355149031 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.355164051 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.355200052 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.355222940 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.355406046 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.355453014 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.359643936 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.359709978 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.359766960 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.359802008 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.359828949 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.359847069 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.359855890 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.359869957 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.359905005 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.359932899 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.359961987 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.360011101 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.360197067 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.360253096 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.360277891 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.360291004 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.360327005 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.360352039 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.360460997 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.360474110 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.360486031 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.360512018 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.360538006 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.360624075 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.360636950 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.360649109 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.360677004 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.360707045 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.360979080 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.360991955 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.361005068 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.361016035 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.361025095 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.361027956 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.361042023 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.361053944 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.361057997 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.361068010 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.361080885 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.361083031 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.361097097 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.361115932 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.361134052 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.364695072 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.364748001 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.364763021 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.364775896 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.364798069 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.364810944 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.364811897 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.364823103 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.364837885 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.364886045 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.365108013 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.365120888 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.365149021 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.365164042 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.365190983 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.365200996 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.365205050 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.365253925 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.365259886 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.365303993 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.365464926 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.365478039 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.365489960 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.365514994 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.365544081 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.365797043 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.365809917 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.365822077 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.365843058 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.365878105 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.365931034 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.365943909 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.365974903 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.365979910 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.366018057 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.366038084 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.366137981 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.366149902 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.366182089 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.366200924 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.366281986 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.366295099 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.366307020 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.366317987 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.366328955 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.366362095 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.366380930 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.366400957 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.366415024 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.366446972 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.366467953 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.366492987 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.366506100 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.366539001 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.366561890 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.369627953 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.369678974 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.369709969 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.369723082 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.369748116 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.369765043 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.369775057 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.369777918 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.369791985 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.369806051 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.369837999 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.369914055 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.369939089 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.369961977 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.370003939 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.370055914 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.370100975 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.370114088 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.370163918 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.370198011 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.370212078 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.370223999 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.370237112 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.370239019 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.370271921 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.370295048 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.370376110 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.370419025 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.370455027 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.370467901 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.370495081 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.370522022 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.370785952 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.370800018 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.370811939 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.370834112 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.370851994 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.370887995 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.370973110 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.370985985 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.371017933 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.371038914 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.371045113 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.371058941 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.371099949 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.371125937 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.371332884 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.371345997 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.371388912 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.371402979 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.371409893 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.371423006 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.371453047 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.371464014 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.371479034 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.371496916 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.371530056 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.371584892 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.371598005 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.371611118 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.371623039 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.371623993 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.371670008 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.371674061 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.371732950 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.374705076 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.374758959 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.374763012 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.374790907 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.374809980 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.374836922 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.374995947 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375021935 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375045061 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375047922 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375072002 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375075102 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375097990 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375108957 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375133038 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375143051 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375144958 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375171900 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375195026 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375199080 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375221014 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375222921 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375250101 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375250101 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375267029 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375277042 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375296116 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375303030 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375324965 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375353098 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375366926 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375411034 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375422955 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375447989 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375472069 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375474930 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375502110 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375503063 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375530005 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375550032 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375706911 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375730991 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375756025 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375766039 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375787020 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375803947 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375917912 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.375968933 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.375998974 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376024008 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376050949 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.376051903 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376071930 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.376100063 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.376487017 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376512051 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376538038 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376552105 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.376571894 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.376591921 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.376620054 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376646042 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376667976 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.376669884 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376692057 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.376694918 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376724005 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.376749992 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.376754999 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376779079 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376797915 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.376802921 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376827955 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376838923 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.376852036 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376854897 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.376880884 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.376883030 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.376907110 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.376926899 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380120039 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380148888 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380172968 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380182981 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380204916 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380206108 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380224943 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380261898 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380379915 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380405903 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380429983 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380434036 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380450010 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380458117 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380476952 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380501032 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380503893 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380530119 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380554914 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380577087 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380578995 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380603075 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380625010 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380626917 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380656958 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380671978 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380676985 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380697966 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380722046 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380729914 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380748987 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380767107 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380779982 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380804062 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380826950 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380832911 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380846024 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380851984 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380865097 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380876064 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380898952 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380917072 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380918980 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380944967 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380968094 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380968094 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.380990028 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.380994081 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.381022930 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.381031990 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.381046057 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.381057024 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.381081104 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.381102085 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.381211042 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.381258011 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.381423950 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.381474018 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.381522894 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.381577015 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.381613016 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.381656885 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.381901979 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.381961107 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.382050037 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.382075071 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.382097006 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.382097960 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.382122993 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.382143974 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.382155895 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.382203102 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.382276058 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.382301092 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.382324934 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.382327080 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.382353067 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.382369995 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.382371902 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.382396936 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.382419109 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.382421970 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.382447004 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.382452011 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.382472992 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.382479906 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.382509947 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.382527113 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.385401011 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.385421991 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.385433912 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.385445118 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.385458946 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.385464907 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.385474920 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.385490894 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.385514975 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.385531902 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.385854959 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.385907888 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.385912895 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.385960102 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.386054993 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386106014 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.386167049 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386182070 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386194944 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386219978 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.386248112 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.386459112 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386472940 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386485100 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386498928 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386508942 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.386543036 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386557102 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386562109 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.386598110 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.386758089 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386771917 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386784077 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386795998 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386807919 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386810064 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.386821032 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386835098 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386847019 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386852980 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.386872053 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386873007 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.386885881 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386898994 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386902094 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.386910915 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386921883 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.386924982 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386939049 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386950970 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386951923 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.386964083 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386976957 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.386982918 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.387006044 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.387021065 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.387120008 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.387132883 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.387156963 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.387168884 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.387171984 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.387197018 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.387212992 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.387219906 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.387269974 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.387340069 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.387352943 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.387406111 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.387407064 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.387450933 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.387464046 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.387497902 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.387525082 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.387530088 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.387542963 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.387554884 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.387583017 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.387603998 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.387612104 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.387619019 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.387654066 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.387679100 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.390342951 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.390400887 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.390415907 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.390441895 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.390451908 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.390490055 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.390490055 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.390505075 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.390548944 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.390559912 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.390566111 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.390619040 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.390650988 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.390697956 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.390909910 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.390958071 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.390991926 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391045094 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.391081095 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391093969 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391105890 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391132116 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.391135931 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391166925 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.391182899 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.391415119 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391463995 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.391472101 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391518116 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.391544104 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391592979 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.391634941 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391648054 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391659975 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391686916 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.391710997 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.391797066 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391809940 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391844988 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.391872883 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.391907930 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391921997 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391943932 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391949892 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.391959906 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391966105 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.391977072 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391994953 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.391998053 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392008066 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392019987 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392034054 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392055988 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392064095 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392065048 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392079115 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392090082 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392112970 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392124891 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392127037 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392141104 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392182112 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392209053 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392312050 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392324924 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392337084 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392366886 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392391920 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392395020 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392405033 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392417908 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392430067 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392441034 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392441988 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392456055 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392468929 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392471075 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392482042 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392493963 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392496109 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392508984 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392527103 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392545938 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392570019 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392585993 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392599106 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392611027 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392621994 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392643929 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392666101 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392699003 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.392797947 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392811060 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.392851114 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.395488024 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.395509005 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.395545006 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.395585060 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.395612001 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.395631075 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.395657063 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.395675898 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.395874023 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.395894051 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.395911932 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.395931005 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.395931005 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.395951033 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.395957947 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.395981073 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.395987988 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.396007061 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.396025896 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.396055937 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.396094084 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.396111965 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.396130085 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.396146059 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.396181107 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.396203041 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.396251917 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.396389008 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.396436930 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.396450043 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.396500111 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.396512985 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.396533012 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.396557093 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.396583080 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.396743059 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.396799088 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397022009 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397039890 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397061110 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397073030 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397104979 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397114038 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397134066 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397159100 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397167921 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397186995 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397197962 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397206068 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397211075 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397233963 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397254944 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397486925 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397505999 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397535086 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397535086 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397557974 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397562981 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397578001 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397587061 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397598028 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397603989 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397619009 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397627115 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397639990 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397648096 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397664070 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397666931 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397685051 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397702932 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397720098 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397721052 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397741079 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397743940 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397761106 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397763014 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397782087 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397789001 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397815943 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397841930 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397861004 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397867918 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397883892 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397887945 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397905111 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.397913933 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397933960 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.397958994 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.398108959 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.398128033 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.398147106 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.398160934 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.398165941 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.398180962 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.398185015 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.398204088 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.398215055 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.398222923 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.398233891 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.398243904 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.398251057 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.398264885 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.398281097 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.398283958 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.398303986 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.398309946 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.398323059 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.398333073 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.398363113 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.398377895 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.400444984 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.400506020 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.400743961 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.400763988 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.400782108 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.400789976 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.400821924 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.400836945 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.400846004 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.400859118 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.400886059 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.400918961 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.400965929 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.400986910 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.401024103 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.401031017 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.401032925 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.401052952 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.401062965 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.401070118 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.401123047 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.401173115 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.401191950 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.401211023 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.401226997 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.401228905 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.401268005 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.401284933 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.401647091 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.401669979 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.401688099 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.401705980 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.401724100 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.401736975 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.401750088 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.401787996 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.401819944 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.402049065 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.402100086 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.402148008 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.402170897 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.402189016 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.402203083 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.402221918 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.402232885 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.402244091 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.402262926 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.402277946 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.402309895 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.402509928 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.402559996 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.436141968 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.436382055 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.436484098 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.436503887 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.441418886 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441437006 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441452026 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441464901 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441477060 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441488028 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441493988 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.441514969 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441528082 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441539049 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441545010 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441559076 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441560030 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.441570997 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441584110 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441596031 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.441596031 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441621065 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441632986 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441633940 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.441647053 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441658974 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441660881 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.441673994 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441685915 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441698074 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.441699028 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441711903 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441735029 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441740990 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.441747904 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441761017 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441761971 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.441773891 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441788912 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441800117 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.441858053 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.484122992 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.484307051 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.484392881 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.484416008 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.532089949 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.532362938 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.532458067 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.532483101 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.537678957 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.537744045 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.537789106 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.537811041 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.537833929 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.537841082 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.537861109 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.537889004 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.537951946 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.537965059 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.537976980 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.537988901 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.537998915 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538012028 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538026094 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538039923 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538042068 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538052082 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538083076 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538083076 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538096905 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538119078 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538132906 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538142920 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538184881 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538197041 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538234949 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538321018 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538333893 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538345098 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538357019 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538367987 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538379908 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538392067 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538398981 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538410902 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538425922 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538429976 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538459063 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538463116 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538475990 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538481951 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538517952 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538523912 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538536072 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538542032 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538549900 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538573980 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538595915 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538649082 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538697004 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538908005 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538921118 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538933039 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.538959026 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.538988113 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.539117098 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539130926 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539141893 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539154053 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539170027 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.539206982 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.539212942 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539222002 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.539227962 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539242029 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539253950 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539264917 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539268017 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.539293051 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.539328098 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.539730072 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539743900 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539755106 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539760113 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539772034 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539779902 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.539784908 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539798021 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539809942 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539812088 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.539822102 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539834976 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539846897 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539849043 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.539860010 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539870977 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539877892 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.539884090 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539899111 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539911032 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539911032 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.539922953 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539932013 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.539937019 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539949894 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539962053 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539968014 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.539974928 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539987087 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.539994001 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.540000916 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.540013075 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.540015936 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.540026903 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.540040970 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.540041924 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.540071964 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.540086031 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.542867899 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.542915106 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.542921066 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.542960882 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543023109 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543035984 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543049097 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543060064 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543068886 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543107986 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543148994 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543162107 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543173075 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543184996 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543196917 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543243885 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543330908 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543344021 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543354988 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543365955 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543379068 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543379068 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543417931 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543417931 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543431997 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543443918 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543451071 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543456078 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543467999 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543494940 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543507099 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543517113 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543529987 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543536901 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543559074 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543584108 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543591022 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543597937 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543610096 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543622017 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543634892 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543646097 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543648958 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543658972 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543670893 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543684006 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543687105 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543725014 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543751001 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543859005 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543870926 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543881893 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.543929100 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.543955088 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.544051886 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.544099092 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.544190884 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.544204950 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.544217110 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.544228077 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.544239998 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.544240952 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.544255018 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.544272900 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.544320107 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.544322968 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.544337034 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.544370890 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.544403076 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.544608116 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.544620991 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.544651985 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.544678926 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.588241100 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.588500977 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.588624954 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.588648081 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.615432024 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.615652084 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.615761042 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.615791082 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.620768070 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.620848894 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.620873928 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.620874882 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.620894909 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.620927095 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.620944023 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.620954037 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.620980978 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.620982885 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.621007919 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.621009111 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.621032953 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.621032953 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.621057987 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.621058941 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.621078014 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.621097088 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.621102095 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.621126890 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.621146917 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.621150970 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.621174097 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.621176004 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.621201038 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.621217966 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.621217966 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.621243000 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.621263027 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.621267080 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.621283054 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.621290922 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.621309996 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.621318102 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.621334076 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.621355057 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.664170980 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.664413929 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.664532900 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.664561987 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.672950983 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.673130989 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.673213959 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.673243999 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678191900 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678210974 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678224087 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678237915 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678267002 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678277016 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678313017 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678334951 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678358078 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678402901 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678412914 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678426981 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678457022 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678483963 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678493977 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678508997 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678520918 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678533077 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678536892 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678545952 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678558111 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678565979 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678571939 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678586006 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678596973 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678600073 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678613901 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678617001 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678638935 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678652048 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678653002 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678663969 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678667068 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678680897 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678695917 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678716898 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678719997 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678730965 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678742886 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678754091 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678769112 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678807020 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678843021 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678854942 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678879023 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678888083 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678900003 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678916931 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678930044 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678931952 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678945065 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.678953886 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.678972960 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.679002047 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.679004908 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.679014921 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.679028988 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.679040909 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.679047108 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.679053068 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.679070950 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.679095984 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.679119110 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.679133892 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.679145098 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.679168940 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.679194927 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.679198027 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.679208994 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.679220915 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.679234028 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.679236889 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.679246902 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.679259062 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.679264069 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.679291010 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.679320097 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.679328918 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.679368973 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.720160007 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.724299908 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.724392891 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.724426985 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.740107059 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.740802050 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.740884066 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.740915060 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746088028 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746105909 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746118069 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746133089 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746155977 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746167898 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746170044 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746211052 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746246099 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746293068 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746304989 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746315956 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746328115 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746344090 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746385098 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746393919 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746407032 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746428967 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746440887 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746442080 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746452093 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746464014 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746464014 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746509075 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746530056 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746581078 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746592999 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746603966 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746614933 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746639967 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746673107 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746681929 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746695042 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746706009 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746716976 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746728897 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746730089 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746741056 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746762991 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746802092 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746831894 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746845007 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746855974 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746866941 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746877909 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746880054 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746890068 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.746912956 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.746957064 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.747020960 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747034073 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747045994 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747057915 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747068882 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747081041 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747087955 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.747109890 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.747136116 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.747149944 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747163057 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747200012 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.747220993 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.747270107 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747283936 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747296095 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747329950 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.747364044 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.747423887 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747437000 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747447968 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747482061 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747493029 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.747493982 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747505903 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747510910 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.747544050 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.747574091 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.747612953 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747625113 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747684002 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.747809887 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747823000 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747833967 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.747881889 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.747904062 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.749278069 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.749298096 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.749310017 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.749321938 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.749356031 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.749399900 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.755165100 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.755235910 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.755249977 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.755361080 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.755551100 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.755605936 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.755767107 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.756071091 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.756176949 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.757661104 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.758413076 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.764072895 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.764244080 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.764312983 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.764353037 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.769359112 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.769459009 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.769551039 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.769587994 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.769690990 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.769737959 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.769751072 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.769773006 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.769783974 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.769798040 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.769839048 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.769910097 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.770010948 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.770092964 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.770720005 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.770752907 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.770765066 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.770865917 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.770869017 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.770939112 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.771289110 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.771368980 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.774386883 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.774817944 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.774914026 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.775185108 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.775360107 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.775372028 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.775422096 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.775630951 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.775830984 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.775895119 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.776824951 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.777502060 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.777650118 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.777728081 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.777751923 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.777765989 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.777817965 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.780800104 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.781151056 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.781239033 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.781349897 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.781461954 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.781513929 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.782392979 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.783473969 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.783585072 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.783766031 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.784143925 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.784254074 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.784604073 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.784657001 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.784744978 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.786350965 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.786497116 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.786813021 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.787050009 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.787122011 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.788760900 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.788881063 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.788970947 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.789133072 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.789146900 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.789215088 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.789508104 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.789520979 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.789531946 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.789577007 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.789602995 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.789614916 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.789618015 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.789628029 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.789649963 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.789685965 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.789753914 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.789880991 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.789932013 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.789932013 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.789990902 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.832190990 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.832448959 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.832525969 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.832567930 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.845398903 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.845733881 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.845865965 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.845921993 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.851370096 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.851450920 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.852478027 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.852629900 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.852726936 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.852772951 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.856684923 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.856750965 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.857589960 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.857650042 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.857956886 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.858035088 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.858489990 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.858587980 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.858602047 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.858656883 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.858689070 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.858741045 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.858958960 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.858973026 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.859019995 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.859055042 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.859364033 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.859376907 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.859450102 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.859580994 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.859641075 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.859710932 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.859774113 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.859807014 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.859843969 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.859857082 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.859860897 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.859916925 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.859963894 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.860013008 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.864458084 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.864530087 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.864569902 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.864645004 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.866589069 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.866735935 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.866835117 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.866871119 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.869781971 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.869856119 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.872432947 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.872555971 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.872575045 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.872649908 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.873697996 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.873847008 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.874983072 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.875046968 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.877813101 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.877875090 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.883444071 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.884824038 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.884906054 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.884959936 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.889878988 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.890734911 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.892651081 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.892811060 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.892874956 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.892924070 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.896024942 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.897810936 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.897891998 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.897897005 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.897906065 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.897965908 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.898036003 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.898209095 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.898297071 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.898334980 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.898380995 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.898432016 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.898850918 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.898875952 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.898888111 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.898977041 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.899113894 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.899127007 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.899163008 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.899195910 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.899904966 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.899998903 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.904776096 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.905390978 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.905545950 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.905616045 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.905638933 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.905942917 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.906039953 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.906359911 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.908457994 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.911478996 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.912058115 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.912070036 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.912223101 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.912300110 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.912341118 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.913217068 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.913299084 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.914968967 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.915075064 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.918590069 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.918613911 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.918761969 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.918843985 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.920222998 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.920789957 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.920979977 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.921067953 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.924974918 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.925151110 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.925371885 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.925461054 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.925971031 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.926588058 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.926712036 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.926942110 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.928754091 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.931346893 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.931739092 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.931824923 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.931881905 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.931973934 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.932012081 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.932082891 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.932112932 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.932199955 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.932244062 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.932256937 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.932292938 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.932324886 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.932411909 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.934204102 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.934288979 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.940033913 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.941977978 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.942065954 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.942117929 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.942173958 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.947149038 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.947375059 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.950851917 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.951019049 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.951096058 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.951144934 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.952285051 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.952470064 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.955955029 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.956125021 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.957709074 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.957818031 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.957832098 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.957858086 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.957932949 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.957981110 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.958956003 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.959041119 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.962150097 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.963056087 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.963148117 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.963223934 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.963434935 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.963507891 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.963538885 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.963553905 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.963604927 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.963634968 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.963753939 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.963808060 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.964277983 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.964579105 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.964680910 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.964798927 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.964812040 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.964859009 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.964903116 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.964915991 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.964930058 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.964970112 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.964992046 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.965080023 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.965282917 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.965295076 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.965351105 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.965475082 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.965487957 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.965537071 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.968791962 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.970670938 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.970683098 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.970695019 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:10.970837116 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.970923901 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:10.970968962 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.012115002 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:11.015027046 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.015151978 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.015202045 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.015261889 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.064179897 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:11.064971924 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.065092087 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.065184116 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.065259933 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.112273932 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:11.113213062 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.113334894 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.113405943 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.113472939 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.160449028 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:11.160875082 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.160959959 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.161012888 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.161076069 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.209111929 CEST	15666	49704	109.107.181.162	192.168.2.5
Oct 10, 2024 18:22:11.211886883 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.212013960 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.212085962 CEST	49704	15666	192.168.2.5	109.107.181.162
Oct 10, 2024 18:22:11.212174892 CEST	49704	15666	192.168.2.5	109.107.181.162

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 10, 2024 18:22:04.073616982 CEST	192.168.2.5	1.1.1.1	0x65da	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 10, 2024 18:22:04.081321001 CEST	1.1.1.1	192.168.2.5	0x65da	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:22:04.081321001 CEST	1.1.1.1	192.168.2.5	0x65da	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 10, 2024 18:22:04.081321001 CEST	1.1.1.1	192.168.2.5	0x65da	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	104.26.12.205	443	5320	C:\Users\user\Desktop\RUN.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 16:22:04 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-10-10 16:22:04 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 16:22:04 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d07f277a8a715a3-EWR
2024-10-10 16:22:04 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Target ID:	0
Start time:	12:22:03
Start date:	10/10/2024
Path:	C:\Users\user\Desktop\RUN.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\RUN.exe"
Imagebase:	0x7ff66b120000
File size:	1'549'312 bytes
MD5 hash:	80FB69110342F1A031B10484EA356055
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:22:03
Start date:	10/10/2024
Path:	C:\Users\user\Desktop\RUN.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\RUN.exe"
Imagebase:	0x7ff66b120000
File size:	1'549'312 bytes
MD5 hash:	80FB69110342F1A031B10484EA356055
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000001.00000002.2204235009.0000024213155000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:22:20
Start date:	10/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\RUN.exe"
Imagebase:	0x7ff79bae0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:22:20
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:22:20
Start date:	10/10/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 1.1.1.1 -n 1 -w 3000
Imagebase:	0x7ff762530000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11%
Total number of Nodes:	136
Total number of Limit Nodes:	8

Executed Functions

Function 00007FF66B1216A0 Relevance: 141.5, APIs: 63, Strings: 17, Instructions: 1465stringlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66B15CDA0: malloc.MSVCRT ref: 00007FF66B15CDB7

memcpy.MSVCRT ref: 00007FF66B1216E2
strlen.MSVCRT ref: 00007FF66B12170F
WideCharToMultiByte.KERNEL32 ref: 00007FF66B121893
strcpy_s.MSVCRT ref: 00007FF66B1218AE
strcpy_s.MSVCRT ref: 00007FF66B1218C3
strcpy_s.MSVCRT ref: 00007FF66B1218D5
_strlwr.MSVCRT ref: 00007FF66B1218DA
_strlwr.MSVCRT ref: 00007FF66B1218E3
strstr.MSVCRT ref: 00007FF66B1218EF
strcmp.MSVCRT ref: 00007FF66B121969
CreateFileA.KERNELBASE ref: 00007FF66B1219C4
WideCharToMultiByte.KERNEL32 ref: 00007FF66B121AA3
strcpy_s.MSVCRT ref: 00007FF66B121AB9
strcpy_s.MSVCRT ref: 00007FF66B121AC6
strcpy_s.MSVCRT ref: 00007FF66B121AD8
_strlwr.MSVCRT ref: 00007FF66B121ADD
_strlwr.MSVCRT ref: 00007FF66B121AE6
strstr.MSVCRT ref: 00007FF66B121AF2
strcmp.MSVCRT ref: 00007FF66B121B76
NtWriteFile.NTDLL ref: 00007FF66B121BDC
WideCharToMultiByte.KERNEL32 ref: 00007FF66B121C93
_strlwr.MSVCRT ref: 00007FF66B121CCD
_strlwr.MSVCRT ref: 00007FF66B121CD6
strstr.MSVCRT ref: 00007FF66B121CE2
strcmp.MSVCRT ref: 00007FF66B121D56
NtClose.NTDLL ref: 00007FF66B121D83
LoadLibraryW.KERNEL32 ref: 00007FF66B121D8F
GetProcAddress.KERNEL32 ref: 00007FF66B121DB7
GetProcAddress.KERNEL32 ref: 00007FF66B121DC7
LdrLoadDll.NTDLL ref: 00007FF66B121E02
strcmp.MSVCRT ref: 00007FF66B121E87
memcpy.MSVCRT ref: 00007FF66B1223A6
strcmp.MSVCRT ref: 00007FF66B1227A6

Strings

Execute, xrefs: 00007FF66B121E0D
a.ex, xrefs: 00007FF66B1222B8
LdrUnloa, xrefs: 00007FF66B122405
.dll, xrefs: 00007FF66B1217F8
a.exe:extractor.dll, xrefs: 00007FF66B121DE7
ntdll.dll, xrefs: 00007FF66B121D88
Memo, xrefs: 00007FF66B1220A3
basic_string: construction from null is not valid, xrefs: 00007FF66B1225EB
RtlInitUnicodeString, xrefs: 00007FF66B121DAD
eggg, xrefs: 00007FF66B123010
leA, xrefs: 00007FF66B1217E5
ile, xrefs: 00007FF66B1219E6
LdrLoadDll, xrefs: 00007FF66B121DBD
dDll, xrefs: 00007FF66B1223E5
CreateFikernel32NtWriteFNtClose, xrefs: 00007FF66B12179F
eggg, xrefs: 00007FF66B122DFC
eggg, xrefs: 00007FF66B122F09

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: _strlwrstrcpy_s$strcmp$ByteCharMultiWidestrstr$AddressFileLoadProcmemcpy$CloseCreateLibraryWritemallocstrlen
String ID: .dll$CreateFikernel32NtWriteFNtClose$Execute$LdrLoadDll$LdrUnloa$Memo$RtlInitUnicodeString$a.ex$a.exe:extractor.dll$basic_string: construction from null is not valid$dDll$eggg$eggg$eggg$ile$leA$ntdll.dll
API String ID: 3908421497-1771683211
Opcode ID: 1d5c80d7f578658f1db0f5277519c231cd3791395f39275dc7edbb7f11f061e5
Instruction ID: f0c55f654fb0262469a9a0a16761cfb21c1191073640262951bb05bf0221e543
Opcode Fuzzy Hash: 1d5c80d7f578658f1db0f5277519c231cd3791395f39275dc7edbb7f11f061e5
Instruction Fuzzy Hash: AEE27E72A08681D2EA60CF15E5403AEB7B1FB8DB88F444135DA8D8BBA4DF3DE555CB40

Function 00007FF8A8E01690 Relevance: 40.4, APIs: 19, Strings: 4, Instructions: 193
libraryloaderinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8A8E01710
LoadLibraryA.KERNEL32 ref: 00007FF8A8E01736
GetProcAddress.KERNEL32 ref: 00007FF8A8E01789
GetProcAddress.KERNEL32 ref: 00007FF8A8E017BA
GetProcAddress.KERNEL32 ref: 00007FF8A8E017F7
GetProcAddress.KERNEL32 ref: 00007FF8A8E0182C
GetModuleFileNameA.KERNEL32 ref: 00007FF8A8E01857
CreateProcessA.KERNELBASE ref: 00007FF8A8E01894
FreeLibrary.KERNEL32 ref: 00007FF8A8E018AA
FreeLibrary.KERNEL32 ref: 00007FF8A8E018AF
VirtualAlloc.KERNEL32 ref: 00007FF8A8E018D9
GetThreadContext.KERNEL32 ref: 00007FF8A8E018F1
VirtualAllocEx.KERNELBASE ref: 00007FF8A8E0192E
WriteProcessMemory.KERNELBASE ref: 00007FF8A8E0194D
WriteProcessMemory.KERNELBASE ref: 00007FF8A8E01998
WriteProcessMemory.KERNELBASE ref: 00007FF8A8E019C0
SetThreadContext.KERNEL32 ref: 00007FF8A8E019E7
ResumeThread.KERNEL32 ref: 00007FF8A8E019F2
WaitForSingleObject.KERNEL32 ref: 00007FF8A8E019FF

Strings

lloc, xrefs: 00007FF8A8E017C5
kernel32ntdll.dlCreatePr, xrefs: 00007FF8A8E016F9
VirtualA, xrefs: 00007FF8A8E017D5
@, xrefs: 00007FF8A8E01926

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: AddressLibraryProcProcess$MemoryThreadWrite$AllocContextFreeLoadVirtual$CreateFileModuleNameObjectResumeSingleWait
String ID: @$VirtualA$kernel32ntdll.dlCreatePr$lloc
API String ID: 4114231647-2595456714
Opcode ID: c329c931c8ad2b0ca9eb779051fbe313b7b61dcb5e19165ce24ae72118e02771
Instruction ID: 80d666b05241bf4d2cba3613573b29c833cd9173ebdb130697ec57ca450bceaa
Opcode Fuzzy Hash: c329c931c8ad2b0ca9eb779051fbe313b7b61dcb5e19165ce24ae72118e02771
Instruction Fuzzy Hash: 26914D32619B8196E760CB26F8447AAB7A0FB88BC4F444125DECD47B68DF7CD185CB14

Function 00007FF66B1225D1 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 345
stringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF66B13BDE0: RtlCaptureContext.KERNEL32 ref: 00007FF66B13BE5E
Part of subcall function 00007FF66B13BDE0: RtlUnwindEx.KERNEL32 ref: 00007FF66B13BE7C
Part of subcall function 00007FF66B13BDE0: abort.MSVCRT ref: 00007FF66B13BE82

Part of subcall function 00007FF66B15CDA0: malloc.MSVCRT ref: 00007FF66B15CDB7

Part of subcall function 00007FF66B15CDA0: malloc.MSVCRT ref: 00007FF66B15CE1A

strcmp.MSVCRT ref: 00007FF66B1227A6
NtProtectVirtualMemory.NTDLL ref: 00007FF66B1227F3
strcmp.MSVCRT ref: 00007FF66B1228B6
strcmp.MSVCRT ref: 00007FF66B122DAA
strcmp.MSVCRT ref: 00007FF66B122EB5

Strings

basic_string: construction from null is not valid, xrefs: 00007FF66B1225EB

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: strcmp$malloc$CaptureContextMemoryProtectUnwindVirtualabort
String ID: basic_string: construction from null is not valid
API String ID: 3335607169-2991274800
Opcode ID: 889d683e3c19fa97c71aa7ba89f5e1bee264d1ba4f57934af643f07797ff3aa9
Instruction ID: 7301dce3695bb8410103f2f1d48fa26031193890e49ebb690b035665e15fdaff
Opcode Fuzzy Hash: 889d683e3c19fa97c71aa7ba89f5e1bee264d1ba4f57934af643f07797ff3aa9
Instruction Fuzzy Hash: BF025C72A18AC2E2EA609F15E4403EEB7B0FB89748F444235DA8D8B764DF3DE555CB40

Function 00007FF66B121180 Relevance: 12.2, APIs: 8, Instructions: 191
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF66B1211DE
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF66B12124B
malloc.MSVCRT ref: 00007FF66B121312
strlen.MSVCRT ref: 00007FF66B121334
malloc.MSVCRT ref: 00007FF66B121340
memcpy.MSVCRT ref: 00007FF66B121358
GetStartupInfoA.KERNEL32 ref: 00007FF66B121443

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpystrlen
String ID:
API String ID: 649803965-0
Opcode ID: b9ea7d52b2d10031b6286852ea58a9678844d50c5c92490324d83c833a674caa
Instruction ID: 40285270dd5618db527838b444bed773944cfd889e0e229adda1050ccb7c7fe5
Opcode Fuzzy Hash: b9ea7d52b2d10031b6286852ea58a9678844d50c5c92490324d83c833a674caa
Instruction Fuzzy Hash: 76816731A08652E6FA24EB16E551379A3B5AF4AB8CF444035DE0DCF7B1DE3EE8908300

Function 00007FF66B123590 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134
stringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF66B123440: WideCharToMultiByte.KERNEL32 ref: 00007FF66B123500
Part of subcall function 00007FF66B123440: strcpy_s.MSVCRT ref: 00007FF66B123516
Part of subcall function 00007FF66B123440: strcpy_s.MSVCRT ref: 00007FF66B123524
Part of subcall function 00007FF66B123440: strcpy_s.MSVCRT ref: 00007FF66B123532
Part of subcall function 00007FF66B123440: _strlwr.MSVCRT ref: 00007FF66B123538
Part of subcall function 00007FF66B123440: _strlwr.MSVCRT ref: 00007FF66B123541
Part of subcall function 00007FF66B123440: strstr.MSVCRT ref: 00007FF66B12354D

strcmp.MSVCRT ref: 00007FF66B12365A
strcmp.MSVCRT ref: 00007FF66B1236FA
NtQueryInformationProcess.NTDLL ref: 00007FF66B123736

Strings

onProcesntdll.dll, xrefs: 00007FF66B1235B3

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: strcpy_s$_strlwrstrcmp$ByteCharInformationMultiProcessQueryWidestrstr
String ID: onProcesntdll.dll
API String ID: 1398458973-3366486540
Opcode ID: f1d89bea083f99c4f6bbdb13ea71029d17944b1983adebca5988770642fe2c09
Instruction ID: 0f12bd3ba8c228c53d8ec79cfdfb285fb9e8c63cc7339f12fd6387dd8af16eb6
Opcode Fuzzy Hash: f1d89bea083f99c4f6bbdb13ea71029d17944b1983adebca5988770642fe2c09
Instruction Fuzzy Hash: 4D51D462E08681EAEB618B15A44077AB7B4FF8974CF085134DE4D873A4EF3CE596C700

Function 00007FF8A8E222C0 Relevance: 22.9, APIs: 3, Strings: 10, Instructions: 120
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcmp.MSVCRT ref: 00007FF8A8E223BF
malloc.MSVCRT ref: 00007FF8A8E22448
strtoul.MSVCRT ref: 00007FF8A8E22493

Strings

:, xrefs: 00007FF8A8E22377
=, xrefs: 00007FF8A8E223C8
obj_count, xrefs: 00007FF8A8E22333, 00007FF8A8E223B8
., xrefs: 00007FF8A8E2238B
.eh_pool, xrefs: 00007FF8A8E22304
=, xrefs: 00007FF8A8E223A5
obj_size, xrefs: 00007FF8A8E2231E
obj_size, xrefs: 00007FF8A8E22391
GLIBCXX_TUNABLES, xrefs: 00007FF8A8E222E1
glibcxx., xrefs: 00007FF8A8E222F3

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: mallocmemcmpstrtoul
String ID: .$.eh_pool$:$=$=$GLIBCXX_TUNABLES$glibcxx.$obj_count$obj_size$obj_size
API String ID: 920383374-3633263654
Opcode ID: adf3d7f5175feb1777846852d1f2af30fe1d5e279db8b4da270c13a8be9b5945
Instruction ID: 8dac94ed804377510f359880d765fe4d43f1309bab91f29c2a32c6ae14a370ab
Opcode Fuzzy Hash: adf3d7f5175feb1777846852d1f2af30fe1d5e279db8b4da270c13a8be9b5945
Instruction Fuzzy Hash: D4519A31A0B687E5FF119B20E840379A7A4EB487C4F584035EA8D46698FF3DE564C728

Function 00007FF66B15D9C0 Relevance: 22.9, APIs: 3, Strings: 10, Instructions: 120
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcmp.MSVCRT ref: 00007FF66B15DABF
malloc.MSVCRT ref: 00007FF66B15DB48
strtoul.MSVCRT ref: 00007FF66B15DB93

Strings

:, xrefs: 00007FF66B15DA77
.eh_pool, xrefs: 00007FF66B15DA04
=, xrefs: 00007FF66B15DAC8
., xrefs: 00007FF66B15DA8B
obj_size, xrefs: 00007FF66B15DA1E
GLIBCXX_TUNABLES, xrefs: 00007FF66B15D9E1
=, xrefs: 00007FF66B15DAA5
glibcxx., xrefs: 00007FF66B15D9F3
obj_size, xrefs: 00007FF66B15DA91
obj_count, xrefs: 00007FF66B15DA33, 00007FF66B15DAB8

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: mallocmemcmpstrtoul
String ID: .$.eh_pool$:$=$=$GLIBCXX_TUNABLES$glibcxx.$obj_count$obj_size$obj_size
API String ID: 920383374-3633263654
Opcode ID: 9c29e72dc19d8110bb4db6a39bdd3ee898821528617a998e2502974fc6ba40b9
Instruction ID: 1da758f86242d5affabf04c80a7484302e151facbfe79cfa316ce65e3ef4f6c0
Opcode Fuzzy Hash: 9c29e72dc19d8110bb4db6a39bdd3ee898821528617a998e2502974fc6ba40b9
Instruction Fuzzy Hash: B2517DB3A5D642E5FB618B11E44077AA6B5EB4D78CF584035D98DCE2B4EE2CE680C308

Function 00007FF8A8E011D0 Relevance: 7.7, APIs: 5, Instructions: 164
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF8A8E0128D
_amsg_exit.MSVCRT ref: 00007FF8A8E012BC

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 036d39fbe0bf722972d9f45367ac3dec8b455faca4da9ea0d694ab236fe929a8
Instruction ID: 1496872c32d1324554321741f976241efdd3a3f3c817102e3e481650a42597c4
Opcode Fuzzy Hash: 036d39fbe0bf722972d9f45367ac3dec8b455faca4da9ea0d694ab236fe929a8
Instruction Fuzzy Hash: BC51D230E0F203E6F7149B66994027A62A5EF95BC0F044435DE8DCB7D6EF3CA5615278

Function 00007FF8A8E21C20 Relevance: 2.6, APIs: 2, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF8A8E21C37

Part of subcall function 00007FF8A8E21D00: malloc.MSVCRT ref: 00007FF8A8E21D0F

malloc.MSVCRT ref: 00007FF8A8E21C9A

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: a58b26fb905e174e8d7504d9dd70196b90192e5a9dbd69dd6d80ecc553328d74
Instruction ID: 08622a48b83a307fb9836406139709bae938112d6971142260a9a06bf4f05294
Opcode Fuzzy Hash: a58b26fb905e174e8d7504d9dd70196b90192e5a9dbd69dd6d80ecc553328d74
Instruction Fuzzy Hash: B6119E71F0B742E5FF59A765A5223B81281DF087D0F544A34DAAD063C6FF3CB6608228

Function 00007FF66B15CDA0 Relevance: 2.6, APIs: 2, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF66B15CDB7

Part of subcall function 00007FF66B15CE80: malloc.MSVCRT ref: 00007FF66B15CE8F

malloc.MSVCRT ref: 00007FF66B15CE1A

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 5e6a0a7c73f9e692e5b24252d3044150f47de3d201d5c57f604c155f5d738856
Instruction ID: 53654e7dfa9daff7a1111ad700794a6bae741dfe3cb0e232a6f60c414db8c0d9
Opcode Fuzzy Hash: 5e6a0a7c73f9e692e5b24252d3044150f47de3d201d5c57f604c155f5d738856
Instruction Fuzzy Hash: A01108E2F0A746E1FE69AB65E51137891B19F4C7ACF444534C92DCF3E2EE2CA4918344

Function 00007FF8A8E183A0 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsFree.KERNEL32 ref: 00007FF8A8E183A4

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: afec1819db440a2c43305ab5f6e24615eb68956a064f617c0aaae620ebece080
Instruction ID: 866ec89f9168d473a99ca2e5ad5568a26b27b4db8b3528495081fc24dfca41fc
Opcode Fuzzy Hash: afec1819db440a2c43305ab5f6e24615eb68956a064f617c0aaae620ebece080
Instruction Fuzzy Hash: 5EC04824F1FAA3E2E6986B766C8216111A0FF58780F949034C91980250DF6CA2A68A39

Function 00007FF66B13B930 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsFree.KERNEL32 ref: 00007FF66B13B934

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: 25f1e5bf67d653dd683ad626c2ab73248ef7bfd47657521ffb2a3e5076fd6e9a
Instruction ID: 4e327275b09c929df616f7dfa7b39c3efe2d925e922b1f83be01a550677587e9
Opcode Fuzzy Hash: 25f1e5bf67d653dd683ad626c2ab73248ef7bfd47657521ffb2a3e5076fd6e9a
Instruction Fuzzy Hash: 90C04C15F59942D1E65427639E8213111F46F4C795F9040B0D50CC8160ED5C95969F16

Function 00007FF8A8E1F7B0 Relevance: 1.3, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 00007FF8A8E1F808

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0c35b97ced1bec1fa693b917d1a2d0d85617581464d43c5e25326eda2600a28e
Instruction ID: 552fdc06c5f0cdb5bcf91573c3a3a7be379786a3c9b48e17fe090633230e0e99
Opcode Fuzzy Hash: 0c35b97ced1bec1fa693b917d1a2d0d85617581464d43c5e25326eda2600a28e
Instruction Fuzzy Hash: 86F09022F2A652A1FE951B7195047AD4110EFA4BE0F088631DE4C06785DF7CA4B28364

Non-executed Functions

Function 00007FF66B1237A0 Relevance: 93.9, APIs: 46, Strings: 7, Instructions: 1131stringlibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF66B1238C8
strcpy_s.MSVCRT ref: 00007FF66B1238DB
strcpy_s.MSVCRT ref: 00007FF66B1238E9
strcpy_s.MSVCRT ref: 00007FF66B1238FC
_strlwr.MSVCRT ref: 00007FF66B123902
_strlwr.MSVCRT ref: 00007FF66B123908
strstr.MSVCRT ref: 00007FF66B123911
strcmp.MSVCRT ref: 00007FF66B123999
WideCharToMultiByte.KERNEL32 ref: 00007FF66B123AD8
strcpy_s.MSVCRT ref: 00007FF66B123AEB
strcpy_s.MSVCRT ref: 00007FF66B123AF9
strcpy_s.MSVCRT ref: 00007FF66B123B07
_strlwr.MSVCRT ref: 00007FF66B123B0D
_strlwr.MSVCRT ref: 00007FF66B123B13
strstr.MSVCRT ref: 00007FF66B123B1C
strcmp.MSVCRT ref: 00007FF66B123BB1
Process32First.KERNEL32 ref: 00007FF66B123CB8
GetModuleHandleW.KERNEL32 ref: 00007FF66B123CE6
GetProcAddress.KERNEL32 ref: 00007FF66B123D15
GetCurrentProcess.KERNEL32 ref: 00007FF66B123D23
WideCharToMultiByte.KERNEL32 ref: 00007FF66B123E28
strstr.MSVCRT ref: 00007FF66B123E6E
strcmp.MSVCRT ref: 00007FF66B123EF5
GetExitCodeProcess.KERNEL32 ref: 00007FF66B123F77

Strings

NtOpenProcess, xrefs: 00007FF66B123EEB
0, xrefs: 00007FF66B123A41
ntdll.dll, xrefs: 00007FF66B123E2E
0, xrefs: 00007FF66B123D94
onProcesntdll.dll, xrefs: 00007FF66B12439D
NtClose, xrefs: 00007FF66B123F92, 00007FF66B12415F
ntdll.dll, xrefs: 00007FF66B123CD8, 00007FF66B124388

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: strcpy_s$_strlwr$ByteCharMultiWidestrcmpstrstr$Process$AddressCodeCurrentExitFirstHandleModuleProcProcess32
String ID: 0$0$NtClose$NtOpenProcess$ntdll.dll$ntdll.dll$onProcesntdll.dll
API String ID: 2957762160-2864597353
Opcode ID: 366d074a5c91f768f8f9941f5c1996b23e818bcc2d8ba77f55bdce0c2605b66e
Instruction ID: 8806fdb44adac46bd1edd8054a674702a194b2c5979976771d5e5ed2c8198fa3
Opcode Fuzzy Hash: 366d074a5c91f768f8f9941f5c1996b23e818bcc2d8ba77f55bdce0c2605b66e
Instruction Fuzzy Hash: CBA25E72608681D6EB648F16E95036AB7B1FB8AB88F454135DF8D8B7A8DF3CD851C700

Function 00007FF66B14D5F0 Relevance: 79.1, APIs: 47, Strings: 4, Instructions: 2617stringCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF66B14D685
memcpy.MSVCRT ref: 00007FF66B14D729
strlen.MSVCRT ref: 00007FF66B14D86E
memcpy.MSVCRT ref: 00007FF66B14D8F0

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF66B14D814, 00007FF66B14DA85, 00007FF66B14DCE4, 00007FF66B14DF44, 00007FF66B14E1A7, 00007FF66B14E404, 00007FF66B14E664, 00007FF66B14E8C7, 00007FF66B14EE03, 00007FF66B14F054, 00007FF66B14F2A7, 00007FF66B14F537, 00007FF66B14F559, 00007FF66B14F85E
basic_string::_M_replace_aux, xrefs: 00007FF66B14EBD1, 00007FF66B14F845
basic_string::_S_create, xrefs: 00007FF66B14EBC5, 00007FF66B14F86A, 00007FF66B14F9A3
basic_string::replace, xrefs: 00007FF66B14D7FE, 00007FF66B14D80D, 00007FF66B14DA6F, 00007FF66B14DA7E, 00007FF66B14DCCE, 00007FF66B14DCDD, 00007FF66B14DF2E, 00007FF66B14DF3D, 00007FF66B14E191, 00007FF66B14E1A0, 00007FF66B14E3EE, 00007FF66B14E3FD, 00007FF66B14E64E, 00007FF66B14E65D, 00007FF66B14E8B1, 00007FF66B14E8C0, 00007FF66B14EDED, 00007FF66B14EDFC, 00007FF66B14F03E, 00007FF66B14F04D, 00007FF66B14F291, 00007FF66B14F2A0, 00007FF66B14F530, 00007FF66B14F543, 00007FF66B14F552, 00007FF66B14F857

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_replace_aux$basic_string::_S_create$basic_string::replace
API String ID: 2619041689-978392061
Opcode ID: b43c7009fa0db71d8b526a57b924ce55876bc2659ab767e6332628b895dbbf45
Instruction ID: ed279e49cc10e136d5607dd882456cdcf1c2b1b2385019feda5ffecc380c8d68
Opcode Fuzzy Hash: b43c7009fa0db71d8b526a57b924ce55876bc2659ab767e6332628b895dbbf45
Instruction Fuzzy Hash: 18130163B19686E5EE149F26D9045B9A771AF09BDCF484432EE1C8F7E5EE2CE542C300

Function 00007FF66B14B470 Relevance: 77.0, APIs: 45, Strings: 5, Instructions: 2031COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF66B14B5FA
memcpy.MSVCRT ref: 00007FF66B14B8AA

Strings

basic_string::insert, xrefs: 00007FF66B14BFD3, 00007FF66B14BFF2, 00007FF66B14C718, 00007FF66B14C727, 00007FF66B14CB79, 00007FF66B14CB98, 00007FF66B14CD52, 00007FF66B14CD61, 00007FF66B14CF41, 00007FF66B14CF50, 00007FF66B14CF66, 00007FF66B14D25E
basic_string::assign, xrefs: 00007FF66B14B720, 00007FF66B14B736, 00007FF66B14B9F0
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF66B14B72F, 00007FF66B14BFDA, 00007FF66B14C72E, 00007FF66B14CB80, 00007FF66B14CD68, 00007FF66B14CF57, 00007FF66B14CF6D, 00007FF66B14D265
basic_string::_M_replace_aux, xrefs: 00007FF66B14BB8E, 00007FF66B14C265, 00007FF66B14C55C, 00007FF66B14D24C
basic_string::_S_create, xrefs: 00007FF66B14BFE6, 00007FF66B14C271, 00007FF66B14C568, 00007FF66B14CB8C, 00007FF66B14D271

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_replace_aux$basic_string::_S_create$basic_string::assign$basic_string::insert
API String ID: 3510742995-982419628
Opcode ID: 964997ee065c58036f774918f2f725028d89ef295392f68a9a1db0bdc69b5998
Instruction ID: 2d81a5d3c89c8e87015a64db85f119199843283d1880564cbe0105a80ad202a2
Opcode Fuzzy Hash: 964997ee065c58036f774918f2f725028d89ef295392f68a9a1db0bdc69b5998
Instruction Fuzzy Hash: 76F2FFB2B09646E5EE108F26D5442BDA7B1AF0DB9CF484532DA1D8F7E5EE2CE585C300

Function 00007FF66B156C30 Relevance: 52.4, APIs: 27, Strings: 7, Instructions: 1384stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B156C40
memcpy.MSVCRT ref: 00007FF66B156C89
memcpy.MSVCRT ref: 00007FF66B156D69

Strings

basic_string::insert, xrefs: 00007FF66B157DB8, 00007FF66B157EEA
basic_string::_M_replace, xrefs: 00007FF66B156D0A, 00007FF66B156DEA, 00007FF66B156FFB, 00007FF66B157443, 00007FF66B157793, 00007FF66B157915, 00007FF66B157A95, 00007FF66B157C15, 00007FF66B157DCB
basic_string::_M_replace_aux, xrefs: 00007FF66B1572B7, 00007FF66B15751E, 00007FF66B15761A, 00007FF66B157EF6
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF66B157011, 00007FF66B157437, 00007FF66B157787, 00007FF66B157909, 00007FF66B157A89, 00007FF66B157C09, 00007FF66B157DA9, 00007FF66B157DBF, 00007FF66B157EE0
basic_string::replace, xrefs: 00007FF66B157430, 00007FF66B157780, 00007FF66B157902, 00007FF66B157A82, 00007FF66B157C02, 00007FF66B157DA2
basic_string::_M_create, xrefs: 00007FF66B156F0C, 00007FF66B15720F
basic_string::assign, xrefs: 00007FF66B15700A

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_create$basic_string::_M_replace$basic_string::_M_replace_aux$basic_string::assign$basic_string::insert$basic_string::replace
API String ID: 2619041689-3257055785
Opcode ID: b14709f6a180d2c57cfd1b7ccbc300d29b107e27f784da31b3f7c9540ba238b8
Instruction ID: cd3832aadbdafc67512cea1577a3df919a0d229cc50feef8d2fdfe234d1d6585
Opcode Fuzzy Hash: b14709f6a180d2c57cfd1b7ccbc300d29b107e27f784da31b3f7c9540ba238b8
Instruction Fuzzy Hash: 6AA203B3B09A96E0EB218B25D4111B9E370AB49FDCF948532DE5D8F7A5DE2CE542C304

Function 00007FF66B15BD80 Relevance: 28.0, APIs: 15, Strings: 3, Instructions: 1031stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B15BDA5
memcpy.MSVCRT ref: 00007FF66B15BEAD
memcpy.MSVCRT ref: 00007FF66B15BF0C
memcpy.MSVCRT ref: 00007FF66B15C1B5

Part of subcall function 00007FF66B159AD0: memcpy.MSVCRT ref: 00007FF66B159B70
Part of subcall function 00007FF66B159AD0: memcpy.MSVCRT ref: 00007FF66B159BA4

Strings

basic_string::append, xrefs: 00007FF66B15BFEE, 00007FF66B15C012, 00007FF66B15C2A5, 00007FF66B15C2C9, 00007FF66B15C54B, 00007FF66B15C557
basic_string::_M_create, xrefs: 00007FF66B15BFE2, 00007FF66B15C299, 00007FF66B15C527
basic_string::append, xrefs: 00007FF66B15C805, 00007FF66B15C811, 00007FF66B15CAC5, 00007FF66B15CAD1, 00007FF66B15CD49, 00007FF66B15CD55

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy$strlen
String ID: basic_string::_M_create$basic_string::append$basic_string::append
API String ID: 2619041689-2076559931
Opcode ID: 5166f6b5757f2ae01972d25dab95fd0b05efa420a887c9916b6fb963a7897b14
Instruction ID: ab36698ad15d3ed599f38477f58d69ec64121e2e71064590dc7a794aaef87c08
Opcode Fuzzy Hash: 5166f6b5757f2ae01972d25dab95fd0b05efa420a887c9916b6fb963a7897b14
Instruction Fuzzy Hash: DA829DB3B09A46E0EA109F26D4042BEA771AB49FDCF548532DA1E8F7A5DE3CE541C344

Function 00007FF66B14929E Relevance: 18.5, APIs: 9, Strings: 3, Instructions: 513COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF66B149391
memcpy.MSVCRT ref: 00007FF66B1493B9

Part of subcall function 00007FF66B15CDA0: malloc.MSVCRT ref: 00007FF66B15CDB7

memset.MSVCRT ref: 00007FF66B14940D
memcpy.MSVCRT ref: 00007FF66B149466
memcpy.MSVCRT ref: 00007FF66B149649
memcpy.MSVCRT ref: 00007FF66B149677
memcpy.MSVCRT ref: 00007FF66B1496D0

Strings

basic_string::at: __n (which is %zu) >= this->size() (which is %zu), xrefs: 00007FF66B1499AC
basic_string::_M_replace_aux, xrefs: 00007FF66B149570
basic_string::_S_create, xrefs: 00007FF66B149564, 00007FF66B14983D, 00007FF66B14991F

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy$mallocmemset
String ID: basic_string::_M_replace_aux$basic_string::_S_create$basic_string::at: __n (which is %zu) >= this->size() (which is %zu)
API String ID: 368144878-3359409074
Opcode ID: a0dea774e3750bdcd954db3118cc2827cf641b9aa75ffd369047a8399464ee7c
Instruction ID: 6fdfa5790333e9d6ccb46c6424cd0c86642c154ab4fc4b54d48baf31d31bfd5d
Opcode Fuzzy Hash: a0dea774e3750bdcd954db3118cc2827cf641b9aa75ffd369047a8399464ee7c
Instruction Fuzzy Hash: 5912E672B09642E9EA208F16D6546BDA771AB49BECF584531DE1C8F3E6DE3CE581C300

Function 00007FF8A8E1AED0 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 542COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF8A8E1B121
fputc.MSVCRT ref: 00007FF8A8E1B3A9
fputc.MSVCRT ref: 00007FF8A8E1B4E8

Strings

., xrefs: 00007FF8A8E1B329

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: fputc
String ID: .
API String ID: 1992160199-248832578
Opcode ID: d39005f12024fb3bc23f412d7ac4ffb7e71369ea58af91583f7d31a02580f966
Instruction ID: 5496c4b3a09d19bfbed144b8598ebaa77d44e15a075829431ecef271e6af6f8c
Opcode Fuzzy Hash: d39005f12024fb3bc23f412d7ac4ffb7e71369ea58af91583f7d31a02580f966
Instruction Fuzzy Hash: 3522D673B1A242DAE7A98F25C05077D77A2EBA8B88F158135DA0D47788DB3CEC10C764

Function 00007FF66B13E450 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 542COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF66B13E6A1
fputc.MSVCRT ref: 00007FF66B13E929
fputc.MSVCRT ref: 00007FF66B13EA68

Strings

., xrefs: 00007FF66B13E8A9

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: fputc
String ID: .
API String ID: 1992160199-248832578
Opcode ID: f2335e7aae4a5d6319f253de6a1438e5547aa12490883e51a64923facd17ed70
Instruction ID: 3eb869f39e014940ce2718e8fe2c9ea9298f0982f2c677f7894388a4c4a6f20f
Opcode Fuzzy Hash: f2335e7aae4a5d6319f253de6a1438e5547aa12490883e51a64923facd17ed70
Instruction Fuzzy Hash: 0222B173A28342D6E7698E25D050779B7B1EB48B4CF144135CA0E8B798EE3DEE418760

Function 00007FF8A8E12CF0 Relevance: 15.7, APIs: 4, Strings: 6, Instructions: 698stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 00007FF8A8E12D31
strlen.MSVCRT ref: 00007FF8A8E12E3E

Strings

_, xrefs: 00007FF8A8E13102
_GLOBAL_, xrefs: 00007FF8A8E12D27
_, xrefs: 00007FF8A8E12D8D
Z, xrefs: 00007FF8A8E12EFE
_, xrefs: 00007FF8A8E12EF1
Z, xrefs: 00007FF8A8E12D97

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: strlenstrncmp
String ID: Z$Z$_$_$_$_GLOBAL_
API String ID: 1310274236-662103887
Opcode ID: 8ebb671ede4c0b090eee67c06e0a71d2930acf758b112c288f9a7d8f89799bcb
Instruction ID: 90bf7350fb40d7feba17e5405f34b7f8f22459c63abfbfc969fce2595a11039d
Opcode Fuzzy Hash: 8ebb671ede4c0b090eee67c06e0a71d2930acf758b112c288f9a7d8f89799bcb
Instruction Fuzzy Hash: 8562CF72A0A282EAFBA58E21C8543FD37A1FB157C8F144035DA1E0BB89DF7D9564C718

Function 00007FF66B135F60 Relevance: 15.7, APIs: 4, Strings: 6, Instructions: 698stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 00007FF66B135FA1
strlen.MSVCRT ref: 00007FF66B1360AE

Strings

Z, xrefs: 00007FF66B136007
_, xrefs: 00007FF66B136161
_, xrefs: 00007FF66B136372
Z, xrefs: 00007FF66B13616E
_, xrefs: 00007FF66B135FFD
_GLOBAL_, xrefs: 00007FF66B135F97

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: strlenstrncmp
String ID: Z$Z$_$_$_$_GLOBAL_
API String ID: 1310274236-662103887
Opcode ID: 85742cbb5f10b908673ed06d7fdadb6439094f393b2c8fd004835dcad8abd28c
Instruction ID: 8de5e7280d38907c3eb9ef8351f6b9694c16fa9afc37b1425a2bbed0f28eda27
Opcode Fuzzy Hash: 85742cbb5f10b908673ed06d7fdadb6439094f393b2c8fd004835dcad8abd28c
Instruction Fuzzy Hash: 7B629072A0C689EAFB658E2184543FD76B1EB0978CF144035DA0D8FBA9EF7D9A41C740

Function 00007FF66B15ACD0 Relevance: 15.4, APIs: 6, Strings: 4, Instructions: 387COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF66B15AD52

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF66B15AEF0, 00007FF66B15AFC0, 00007FF66B15B090
basic_string::basic_string, xrefs: 00007FF66B15AEE9, 00007FF66B15AFB9
string::string, xrefs: 00007FF66B15B089
basic_string::_M_create, xrefs: 00007FF66B15AD6A, 00007FF66B15AE1A, 00007FF66B15AEDA, 00007FF66B15AFAA, 00007FF66B15B07A, 00007FF66B15B13A

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 3510742995-126128797
Opcode ID: 0beb2d620dd9bf7dc42085457452b8af5c232d12cf8d07ec9f9508c1ce212903
Instruction ID: 018172316729fad3699eb33ac94ee50ff24b0d673812b87eae99139a86eb7acb
Opcode Fuzzy Hash: 0beb2d620dd9bf7dc42085457452b8af5c232d12cf8d07ec9f9508c1ce212903
Instruction Fuzzy Hash: ACC195B3A09A81D5EB115F29F8402B9B7B4E759B98F488131CB5C8B3A1DE3CD9D2C354

Function 00007FF66B15A1B0 Relevance: 15.4, APIs: 6, Strings: 4, Instructions: 387COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF66B15A232

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF66B15A3D0, 00007FF66B15A4A0, 00007FF66B15A570
basic_string::basic_string, xrefs: 00007FF66B15A3C9, 00007FF66B15A499
string::string, xrefs: 00007FF66B15A569
basic_string::_M_create, xrefs: 00007FF66B15A24A, 00007FF66B15A2FA, 00007FF66B15A3BA, 00007FF66B15A48A, 00007FF66B15A55A, 00007FF66B15A61A

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 3510742995-126128797
Opcode ID: 62ac05373f618417ef86ea9eda8f16d10cc7dd08346fbcf3b8452b321d9aafc0
Instruction ID: e97cf0167f89889e5720d5671e8de6d4ad46f34c3b4b3d47b8aca53b0f225283
Opcode Fuzzy Hash: 62ac05373f618417ef86ea9eda8f16d10cc7dd08346fbcf3b8452b321d9aafc0
Instruction Fuzzy Hash: B9C1A4B3A19A81D5EB115F69F4402B8B7B4E759B98F488131CB5C8B3A1DE3CD9D2C314

Function 00007FF66B14AE30 Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 336stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B14AE41
memcpy.MSVCRT ref: 00007FF66B14AF32
memcpy.MSVCRT ref: 00007FF66B14AF9A
memcpy.MSVCRT ref: 00007FF66B14B24A

Strings

basic_string::assign, xrefs: 00007FF66B14B0E0, 00007FF66B14B390

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy$strlen
String ID: basic_string::assign
API String ID: 2619041689-2385367300
Opcode ID: 712d1ee6cb1ca39c704ab21b67f517ebb28fe50130a180ddb81502c35cb3cf10
Instruction ID: 7f56ecec58e146df8a25c1d970f9482e65db903e2e3033443467d1954548cf86
Opcode Fuzzy Hash: 712d1ee6cb1ca39c704ab21b67f517ebb28fe50130a180ddb81502c35cb3cf10
Instruction Fuzzy Hash: C4D19972B1965AE5EE218F1AD4442BDB770AB49F9CF544531DE1D8F7E0DE2CE9828300

Function 00007FF66B15B8C0 Relevance: 10.8, APIs: 5, Strings: 2, Instructions: 273stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B15B8D0
memcpy.MSVCRT ref: 00007FF66B15B918
memcpy.MSVCRT ref: 00007FF66B15B9D0

Strings

basic_string::append, xrefs: 00007FF66B15B96A, 00007FF66B15BA1B, 00007FF66B15BACB
basic_string::_M_create, xrefs: 00007FF66B15BBF0

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy$strlen
String ID: basic_string::_M_create$basic_string::append
API String ID: 2619041689-3923985592
Opcode ID: 76b11affea8e570bf0bc8daf217fc9300ee95b7a484283d9afd19a6176d0d0c6
Instruction ID: 4a33fb52501bce71211cca9dd03792faaccecb77e86b696850aa4b7f71412718
Opcode Fuzzy Hash: 76b11affea8e570bf0bc8daf217fc9300ee95b7a484283d9afd19a6176d0d0c6
Instruction Fuzzy Hash: 2491B6F3B0964AE4EA108F26D5502BAA771AB49F9CF848531DE5D8F7E5DE2CE442C304

Function 00007FF8A8E1C5B0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 1533COMMON

Download Yara Rule

Strings

, xrefs: 00007FF8A8E1DD33
Infinity, xrefs: 00007FF8A8E1C980
, xrefs: 00007FF8A8E1E09E
NaN, xrefs: 00007FF8A8E1C8F1

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID:
String ID: $ $Infinity$NaN
API String ID: 0-3274152445
Opcode ID: da778f0cd26c90b516ff2772988f0db93639f81fb4b7ea348032394e7e07a4a0
Instruction ID: 10b32976e9ba75cd4585d690916b5ad464c23629243656cab20c4fdd1da965e5
Opcode Fuzzy Hash: da778f0cd26c90b516ff2772988f0db93639f81fb4b7ea348032394e7e07a4a0
Instruction Fuzzy Hash: 00E2B472B0D682DAE7A1CF29E00036ABBA1FB957C4F104135EA4987B99DB3DE451CF14

Function 00007FF66B13FB30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 1533COMMON

Download Yara Rule

Strings

, xrefs: 00007FF66B14161E
, xrefs: 00007FF66B1412B3
NaN, xrefs: 00007FF66B13FE71
Infinity, xrefs: 00007FF66B13FF00

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID:
String ID: $ $Infinity$NaN
API String ID: 0-3274152445
Opcode ID: ef0d0a210892b9a68a8b72f744a3920f20036ed4a4ebdb6b9e4e2010053579a0
Instruction ID: f63f80f70e69d04a8cc907f14a31eb625f3b3758ae7f3b45bf5f3e6ecdd72d82
Opcode Fuzzy Hash: ef0d0a210892b9a68a8b72f744a3920f20036ed4a4ebdb6b9e4e2010053579a0
Instruction Fuzzy Hash: 38E28732A1C681DAE7658F26E40436ABBB0FB9978CF144135EA49CBB65DF3DE4518F00

Function 00007FF66B151D20 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 222stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B151D31
memcpy.MSVCRT ref: 00007FF66B151E22
memcpy.MSVCRT ref: 00007FF66B151E8A

Strings

basic_string::assign, xrefs: 00007FF66B151FD0

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy$strlen
String ID: basic_string::assign
API String ID: 2619041689-2385367300
Opcode ID: 92de5ced38744baf074556cf4c110d164cdc2f5e163c8b2e3b7ddcd833be6887
Instruction ID: c4f494829d1ea43d3bcd9a56559f60fc7624056c6525ba4de2c3328d00509f71
Opcode Fuzzy Hash: 92de5ced38744baf074556cf4c110d164cdc2f5e163c8b2e3b7ddcd833be6887
Instruction Fuzzy Hash: A1918FB3B0A666E5EA128F1AD44427CA371AB49B9CF544531DA0DCF7E0DF2DE891C344

Function 00007FF66B13AF33 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

CCG , xrefs: 00007FF66B13AF55

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 4086a0b043b36be7aecd32a7963eeeb6ffd47896cd0ceabfe914a177ce273ad8
Instruction ID: 95d77035f156578d905812465a879d08bdd4e5690cdb5015245c548f1379acbd
Opcode Fuzzy Hash: 4086a0b043b36be7aecd32a7963eeeb6ffd47896cd0ceabfe914a177ce273ad8
Instruction Fuzzy Hash: E121ABA0E18546E2FE781365809037D90B59F5D72DF18483ACA1DCE3F1FD0EAC818605

Function 00007FF66B1520B0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 234COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF66B1521A2
memcpy.MSVCRT ref: 00007FF66B15220A

Strings

basic_string::assign, xrefs: 00007FF66B152350

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy
String ID: basic_string::assign
API String ID: 3510742995-2385367300
Opcode ID: 6ab1510b188fd0e86d134ef641fb002c513a74cd615e0866d397abb65c89fa8a
Instruction ID: 674f657713e00f98f7c75e7a76950c866ebecf33b6740e4c909351f56157d296
Opcode Fuzzy Hash: 6ab1510b188fd0e86d134ef641fb002c513a74cd615e0866d397abb65c89fa8a
Instruction Fuzzy Hash: 74A1ACB3B0964AE4EE218F1AE54477DE771AB19B9CF544131CB1D8B7A0DE2CE980C384

Function 00007FF66B14FBE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF66B14FD66

Part of subcall function 00007FF66B15CDA0: malloc.MSVCRT ref: 00007FF66B15CDB7

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF66B14FDD4
basic_string::_S_create, xrefs: 00007FF66B14FDE0
basic_string::erase, xrefs: 00007FF66B14FDCD

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: mallocmemcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_S_create$basic_string::erase
API String ID: 4276657696-874136391
Opcode ID: 58525d48c7fd20f31917e229d8ea777a75864351186ad4f706407040cf886123
Instruction ID: 00ae95ac205e4e2a7625f22621f0c253f89edba9a0fff414598c4048658c8e3a
Opcode Fuzzy Hash: 58525d48c7fd20f31917e229d8ea777a75864351186ad4f706407040cf886123
Instruction Fuzzy Hash: 94519E72B09656E5FA108F15D4446B9A775AB49BACF844632DE3CCB3E4EF2CD886C340

Function 00007FF66B159CD0 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF66B159D9D

Strings

basic_string::_M_create, xrefs: 00007FF66B159DE0

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy
String ID: basic_string::_M_create
API String ID: 3510742995-3122258987
Opcode ID: 8c73721c28dc6fbbda2f0a036766c8479ba54f5a3e04b098ad6345b8452a3a00
Instruction ID: 36187fdff02aad718136783fc63861083d46ff27044d21f169acee0fd9068241
Opcode Fuzzy Hash: 8c73721c28dc6fbbda2f0a036766c8479ba54f5a3e04b098ad6345b8452a3a00
Instruction Fuzzy Hash: DC518EF3608A85E1DA198B15D4202BDA771FB49BD8F548632CE2D8B3E6DF38D591C306

Function 00007FF8A8E1F190 Relevance: 2.6, APIs: 2, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8E1E320: Sleep.KERNEL32(00000001,?,00000000,00007FF8A8E1E6AE), ref: 00007FF8A8E1E355

malloc.MSVCRT ref: 00007FF8A8E1F2BE
LeaveCriticalSection.KERNEL32 ref: 00007FF8A8E1F2F0

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: CriticalLeaveSectionSleepmalloc
String ID:
API String ID: 1993596536-0
Opcode ID: 7e2fe93f54d0f0f35c9e097b9d50c1ffc2aa3f44bedecc2140996b3f98b37445
Instruction ID: 9357116186bb3bd666a2711c91d367ee89a57c9d1cde15c129e8b6b1a1624a65
Opcode Fuzzy Hash: 7e2fe93f54d0f0f35c9e097b9d50c1ffc2aa3f44bedecc2140996b3f98b37445
Instruction Fuzzy Hash: C15105B1A19202D6EBAC8F15F404B7A3AA1EBA07C4F519238DA4E07BD4CF3DD551CB94

Function 00007FF66B142710 Relevance: 2.6, APIs: 2, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66B1418A0: Sleep.KERNEL32(00000001,?,00000000,00007FF66B141C2E), ref: 00007FF66B1418D5

malloc.MSVCRT ref: 00007FF66B14283E
LeaveCriticalSection.KERNEL32 ref: 00007FF66B142870

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: CriticalLeaveSectionSleepmalloc
String ID:
API String ID: 1993596536-0
Opcode ID: 98e7d60d868183cdd52a9bcbf71e4bfd39feb9d144f28b661c32f6bafe1ac76a
Instruction ID: ea2015ddd9a2a947b21152db1047b11abe94115c6432e78ba5a6a4c6125a44c2
Opcode Fuzzy Hash: 98e7d60d868183cdd52a9bcbf71e4bfd39feb9d144f28b661c32f6bafe1ac76a
Instruction Fuzzy Hash: BB51C9B1E28202C6E71D4F15F514B796AA1EBA874CF519138CA0D8BBA4CE3CD585CB80

Function 00007FF8A8E20750 Relevance: 2.1, APIs: 1, Instructions: 559COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75202502c96c6c6311f8483e592c34ccd1763e61bf6a8445c6a23aed2556d219
Instruction ID: 5ad9613bbbb630ce815e24b36f5efe8cfc7b0dbbf052af3d00370e04626c6df1
Opcode Fuzzy Hash: 75202502c96c6c6311f8483e592c34ccd1763e61bf6a8445c6a23aed2556d219
Instruction Fuzzy Hash: 1F326D72E0E6C5D5EB609A55A0053BEA791FB897C4F044135EA8E07BDAFF3CE1608B14

Function 00007FF66B143CF0 Relevance: 2.1, APIs: 1, Instructions: 559COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d85f9e947f8d698d61159374551337f9aa608a57d55679348989d293b436d7c1
Instruction ID: a28638dd8f7cc1da4d4a430bb8cedbecbad6e329ab47b5d11c9bd21b6b940951
Opcode Fuzzy Hash: d85f9e947f8d698d61159374551337f9aa608a57d55679348989d293b436d7c1
Instruction Fuzzy Hash: 7732A462A0DBC5D1EA749B55A0513BEE7B0FB8D78CF444135EA8E8BBA9DE3CD4418700

Function 00007FF66B15DC50 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

random_device::random_device(const std::string&): unsupported token, xrefs: 00007FF66B15DCC1

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: CaptureContextUnwindabortmallocstrlen
String ID: random_device::random_device(const std::string&): unsupported token
API String ID: 467726954-222443098
Opcode ID: 9541fe4038f04bb88d6a2e860e81ebca80ea855146675dd0b1876224a806dcb3
Instruction ID: d17f4c6d564969e677258829b00a54dd60cb375731eeeaefee7c2f2328b308e3
Opcode Fuzzy Hash: 9541fe4038f04bb88d6a2e860e81ebca80ea855146675dd0b1876224a806dcb3
Instruction Fuzzy Hash: 282175B2E18647E1E924AB62A9514B9E375BF4DBC8F440031E94DCF7B6DE2CE1018348

Function 00007FF8A8E03C10 Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26e0fa4ba8de209f33d981733c211bfc04209555fe558efc360ad56f06d6f81b
Instruction ID: c2243841320eec59e0e835adf50b55b24f5b133db8af7133fa23a5f8c726de6b
Opcode Fuzzy Hash: 26e0fa4ba8de209f33d981733c211bfc04209555fe558efc360ad56f06d6f81b
Instruction Fuzzy Hash: 5312B5B2E4BB42E1FB654700A54177A26F5EF517C8F558831CA4C07785DF3CEAA183A8

Function 00007FF66B126E80 Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26e0fa4ba8de209f33d981733c211bfc04209555fe558efc360ad56f06d6f81b
Instruction ID: 5a9e0e021e1a2a881a5c9281485bcfd9551db5b9dd5de4ccf897ebec6de4c828
Opcode Fuzzy Hash: 26e0fa4ba8de209f33d981733c211bfc04209555fe558efc360ad56f06d6f81b
Instruction Fuzzy Hash: F912D962E09B82D1FB658B01A44177BA6E5EF5B788F558032CA4C4B7E1DE3CE9C18780

Function 00007FF8A8E04460 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a89966a286401408c25dd472d305ca0d404c484534aad0940b22489e1a5209f
Instruction ID: 1af05cdf202ee500af6f63a51e0fd1dd1a8b2143fd529cccc95592ce0b3a07e2
Opcode Fuzzy Hash: 4a89966a286401408c25dd472d305ca0d404c484534aad0940b22489e1a5209f
Instruction Fuzzy Hash: AC12C3B2A4A742D5EB548F11A24037936F1FB55BCCF588934CA4D07789EF3CE8A18798

Function 00007FF66B1276D0 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2cb3a8822b5cb700f201b4021c6dfea5137410ebe53105b0792161ae7a76cd1
Instruction ID: cc22d2a927771cbc85fe5d6741d0b69588654b0418401d1fc7fd428a2afce487
Opcode Fuzzy Hash: f2cb3a8822b5cb700f201b4021c6dfea5137410ebe53105b0792161ae7a76cd1
Instruction Fuzzy Hash: 2912C272A09742D6EB548F11905133FA6B2EB4AB9CF544036CA0D8B7A9DE3CEDD18380

Function 00007FF8A8E06360 Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b057cbbb8f210a0f42a14319dea50cbe7b6f0892c6a6c6128709ea7b62745ec8
Instruction ID: 87240dbd96e72f8c7ebae34ecfed372698fb417d04f275e3590c6a20583fa406
Opcode Fuzzy Hash: b057cbbb8f210a0f42a14319dea50cbe7b6f0892c6a6c6128709ea7b62745ec8
Instruction Fuzzy Hash: 3502B271E8E386E5FB689A15540137A16F1DB41BC4F588831CA4E077E6DF3CE9B183A8

Function 00007FF66B1295D0 Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b057cbbb8f210a0f42a14319dea50cbe7b6f0892c6a6c6128709ea7b62745ec8
Instruction ID: 3a6403fb947428d18b5d55602188f39db79ca2b1baac516007c40ff6f0aa1485
Opcode Fuzzy Hash: b057cbbb8f210a0f42a14319dea50cbe7b6f0892c6a6c6128709ea7b62745ec8
Instruction Fuzzy Hash: 4802F351E0C286E5FB688A295421379A6E29F5BBDCF588031CA4D8F3E7DD3DE9D18340

Function 00007FF8A8E200BA Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f6b61238db992a57c07dc69b439fbe67e8447ddb7986a9a72e22a6da97e4aa
Instruction ID: 3466852752523604f235245902499a4a656a3bcf3510b27d76963fa5ba115582
Opcode Fuzzy Hash: 56f6b61238db992a57c07dc69b439fbe67e8447ddb7986a9a72e22a6da97e4aa
Instruction Fuzzy Hash: DB31453B14F6C08EC71B8B7855A614E3F60B187E1871B87ABDBC5829D7D79E104AC706

Function 00007FF66B29D3B8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b60f15f63746dc28937a41190a4df69956e159dca0dce497e7935c5e971a19b
Instruction ID: 387686801608d1ce75aa39ca697d990abbaf70b3e238d02919cc67f4a5db97e9
Opcode Fuzzy Hash: 2b60f15f63746dc28937a41190a4df69956e159dca0dce497e7935c5e971a19b
Instruction Fuzzy Hash: C9E0928BD8EEC2C5F19210694E262391FE45F16979B0842AACE688A2F3DD066C01770A

Function 00007FF66B124B40 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae039c0ccab655001838bb738bec13e111da24974d0ae1d3d37dbb9c3f3e987e
Instruction ID: 5813d13669751060f7b9ea9dc482dedaa40ff4b35687dd68224cf6ad8f3b5e2c
Opcode Fuzzy Hash: ae039c0ccab655001838bb738bec13e111da24974d0ae1d3d37dbb9c3f3e987e
Instruction Fuzzy Hash: 55D0C987E69A9509C70791BA980159093A80EFB3C4681C325BC18B1756E316B2D10300

Function 00007FF66B15DD49 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: CaptureContextUnwindabort
String ID:
API String ID: 747564614-0
Opcode ID: 14a4bca8487801086fb8889cc84cf2c95fd0bc430f120451cf0585c7b39031a8
Instruction ID: 5f4412401016336882579abfc7281df8602b6d5c0007330fded4196d1f4f6ec8
Opcode Fuzzy Hash: 14a4bca8487801086fb8889cc84cf2c95fd0bc430f120451cf0585c7b39031a8
Instruction Fuzzy Hash: 63D09EA1F5D452E1E854FB6298524B4C2301F5F78CE442071D40EDB2B2EE2CE2914708

Function 00007FF66B14365A Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bcc403a276f1daa522bf2c9d193e09fff5da9de5feb978e7e1f509761831bd3
Instruction ID: ee76e349228bc8072988d7da23ca955108f1d6f0fb79930ed1c422ff1f677ee3
Opcode Fuzzy Hash: 0bcc403a276f1daa522bf2c9d193e09fff5da9de5feb978e7e1f509761831bd3
Instruction Fuzzy Hash: 3FB01213C4CD10C4C2002F20DD002301178A717223B151330C03C982F9EA2CC0008509

Function 00007FF8A8E21450 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 102fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF8A8E2154C

Part of subcall function 00007FF8A8E17240: strlen.MSVCRT ref: 00007FF8A8E172C5
Part of subcall function 00007FF8A8E17240: memcpy.MSVCRT ref: 00007FF8A8E172DE
Part of subcall function 00007FF8A8E17240: free.MSVCRT ref: 00007FF8A8E172E9

fwrite.MSVCRT ref: 00007FF8A8E214C8
fputs.MSVCRT ref: 00007FF8A8E214E2
fwrite.MSVCRT ref: 00007FF8A8E21503
free.MSVCRT ref: 00007FF8A8E21513
fputs.MSVCRT ref: 00007FF8A8E21525
abort.MSVCRT ref: 00007FF8A8E21551
fwrite.MSVCRT ref: 00007FF8A8E21576
abort.MSVCRT ref: 00007FF8A8E2157B
fwrite.MSVCRT ref: 00007FF8A8E215B6
fputs.MSVCRT ref: 00007FF8A8E215C8
fputc.MSVCRT ref: 00007FF8A8E215DC

Strings

terminate called after throwing an instance of ', xrefs: 00007FF8A8E214B8
terminate called recursively, xrefs: 00007FF8A8E2156C
what(): , xrefs: 00007FF8A8E215AF
terminate called without an active exception, xrefs: 00007FF8A8E21542

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: fwrite$fputs$abortfree$fputcmemcpystrlen
String ID: what(): $terminate called after throwing an instance of '$terminate called recursively$terminate called without an active exception
API String ID: 802779101-808685626
Opcode ID: 4599060c24f642b13191486e71167f8d45c0375b6d69b4c92fde5fe4cca3509c
Instruction ID: f3c22db3de63710c6d9079c06fb16db46415b12a006dcf943d8d6781cc0689e3
Opcode Fuzzy Hash: 4599060c24f642b13191486e71167f8d45c0375b6d69b4c92fde5fe4cca3509c
Instruction Fuzzy Hash: 05416A30A1A112A1FB60A7B1A815BB95642EF867C0F404136E94E477C6FF7DE6118369

Function 00007FF66B144D00 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 102fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF66B144DFC

Part of subcall function 00007FF66B13A4B0: strlen.MSVCRT ref: 00007FF66B13A535
Part of subcall function 00007FF66B13A4B0: memcpy.MSVCRT ref: 00007FF66B13A54E
Part of subcall function 00007FF66B13A4B0: free.MSVCRT ref: 00007FF66B13A559

fwrite.MSVCRT ref: 00007FF66B144D78
fputs.MSVCRT ref: 00007FF66B144D92
fwrite.MSVCRT ref: 00007FF66B144DB3
free.MSVCRT ref: 00007FF66B144DC3
fputs.MSVCRT ref: 00007FF66B144DD5
abort.MSVCRT ref: 00007FF66B144E01
fwrite.MSVCRT ref: 00007FF66B144E26
abort.MSVCRT ref: 00007FF66B144E2B
fwrite.MSVCRT ref: 00007FF66B144E66
fputs.MSVCRT ref: 00007FF66B144E78
fputc.MSVCRT ref: 00007FF66B144E8C

Strings

terminate called without an active exception, xrefs: 00007FF66B144DF2
terminate called recursively, xrefs: 00007FF66B144E1C
terminate called after throwing an instance of ', xrefs: 00007FF66B144D68
what(): , xrefs: 00007FF66B144E5F

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: fwrite$fputs$abortfree$fputcmemcpystrlen
String ID: what(): $terminate called after throwing an instance of '$terminate called recursively$terminate called without an active exception
API String ID: 802779101-808685626
Opcode ID: 8ccee2a0a896c2a7b0b69763dac113bbbf92cd98c01012f72ff686d70be51215
Instruction ID: cd320425126f59fdf971991192c4202251a5bc754b9427fbdb5f2310989bf114
Opcode Fuzzy Hash: 8ccee2a0a896c2a7b0b69763dac113bbbf92cd98c01012f72ff686d70be51215
Instruction Fuzzy Hash: CA41A361F18116E5FB24AB61B8157BA96B19F8DB8CF404435E80ECF7E6EE2DE5028311

Function 00007FF8A8E1F9B0 Relevance: 19.8, APIs: 13, Instructions: 272COMMON

Download Yara Rule

APIs

___lc_codepage_func.MSVCRT ref: 00007FF8A8E1F9DA
___mb_cur_max_func.MSVCRT ref: 00007FF8A8E1F9E2
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF8A8E1FB71
MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E1FB9F
_errno.MSVCRT ref: 00007FF8A8E1FBA5

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func_errno
String ID:
API String ID: 3183172368-0
Opcode ID: fcc235d691e4d26be11642949ad4cf9fe04ed291b385097019a6a1c2a66751d0
Instruction ID: c8e8bd3ec46c3a3046ac312f133f10b3069c7b4f79b2b158b7a39b5f8131b92f
Opcode Fuzzy Hash: fcc235d691e4d26be11642949ad4cf9fe04ed291b385097019a6a1c2a66751d0
Instruction Fuzzy Hash: CDB1B431A1E642EAF7A08F11A44437A6B90FF657C8F048035EA8D47784EF7DE5258768

Function 00007FF66B142ED0 Relevance: 19.8, APIs: 13, Instructions: 272COMMON

Download Yara Rule

APIs

___lc_codepage_func.MSVCRT ref: 00007FF66B142EFA
___mb_cur_max_func.MSVCRT ref: 00007FF66B142F02
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF66B143091
MultiByteToWideChar.KERNEL32 ref: 00007FF66B1430BF
_errno.MSVCRT ref: 00007FF66B1430C5

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func_errno
String ID:
API String ID: 3183172368-0
Opcode ID: f47ad0375922463bdd9f73bb4c64ee8bf7531557e5682a969d60e82a715fbebc
Instruction ID: 0d17a4aa03445290cb168234d278748c9f40281f3eccfbdec17ed52815b3ea6d
Opcode Fuzzy Hash: f47ad0375922463bdd9f73bb4c64ee8bf7531557e5682a969d60e82a715fbebc
Instruction Fuzzy Hash: 2BB19071B18642E6E7648F12A40437ABAB0FB5978CF448135EA8D8F7A4DF7DE4468B40

Function 00007FF8A8E19D00 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 446COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF8A8E19FE5

Strings

UUUU, xrefs: 00007FF8A8E19E2E

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: fputc
String ID: UUUU
API String ID: 1992160199-1798160573
Opcode ID: 6b68097bf7420150babb894e36c6aeaff896fa196c61cd1df292c1f48f671bb8
Instruction ID: fd728e70555f7384f0a75909816d415f3d0a97463944074e30af7f07c9aabd9a
Opcode Fuzzy Hash: 6b68097bf7420150babb894e36c6aeaff896fa196c61cd1df292c1f48f671bb8
Instruction Fuzzy Hash: 6C127672A0A142D6E7E49F24C15077937E1EB65B98F648239CA0D072C9DB3DEC61CB68

Function 00007FF66B13D280 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 446COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF66B13D565

Strings

UUUU, xrefs: 00007FF66B13D3AE

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: fputc
String ID: UUUU
API String ID: 1992160199-1798160573
Opcode ID: 3b85de55c72d650216168256f511233200dee7a2bcb32fa0b97bc0524bea5549
Instruction ID: dbf6a8c8f87f24727d66fd4cf04acf111f5f82c5318822052b9f416759ee2b01
Opcode Fuzzy Hash: 3b85de55c72d650216168256f511233200dee7a2bcb32fa0b97bc0524bea5549
Instruction Fuzzy Hash: 861212B2948242D6E7698F28C150779B7F1EB59B5CF258235CA0D8F699EE38EC418B40

Function 00007FF66B1566E0 Relevance: 16.9, APIs: 8, Strings: 3, Instructions: 427stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B1566F0
memcpy.MSVCRT ref: 00007FF66B156738
memcpy.MSVCRT ref: 00007FF66B1567E6

Strings

basic_string::append, xrefs: 00007FF66B15678A, 00007FF66B15683A, 00007FF66B1568EB, 00007FF66B1569BE, 00007FF66B1569D1, 00007FF66B156A7B
basic_string::_M_replace_aux, xrefs: 00007FF66B156B37
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF66B1569C5

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_replace_aux$basic_string::append
API String ID: 2619041689-2502837630
Opcode ID: fe33d7d4b6210f9a454997c0034592cf050debdc79d948e4469cca2b33a8cc91
Instruction ID: b1027964ce7d1b66a8513b50e1eaff25c1882d4b06f4cec1d85be0fa5ac46c93
Opcode Fuzzy Hash: fe33d7d4b6210f9a454997c0034592cf050debdc79d948e4469cca2b33a8cc91
Instruction Fuzzy Hash: 68E1D1B3B08B4AE5EB108F25D4101B8A370AB59F9CF948532DE5D8B7A5DE2CE452C384

Function 00007FF8A8E17C60 Relevance: 16.6, APIs: 11, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8A8E17CC1
TlsGetValue.KERNEL32(?,?,?,00007FF8A8E17535), ref: 00007FF8A8E17CEA
GetLastError.KERNEL32(?,?,?,00007FF8A8E17535), ref: 00007FF8A8E17CEF
LeaveCriticalSection.KERNEL32 ref: 00007FF8A8E17D17
free.MSVCRT ref: 00007FF8A8E17D57
DeleteCriticalSection.KERNEL32 ref: 00007FF8A8E17D7D
InitializeCriticalSection.KERNEL32 ref: 00007FF8A8E17E17

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorInitializeLastLeaveValuefree
String ID:
API String ID: 100439675-0
Opcode ID: e6b3af72e8468e62411243eb107bfb9d0c90104bcd25452cd5db39969406b84e
Instruction ID: 28b2f6a67603093571bb37777479a006e51c1d59417a7cc548411e1758080b3a
Opcode Fuzzy Hash: e6b3af72e8468e62411243eb107bfb9d0c90104bcd25452cd5db39969406b84e
Instruction Fuzzy Hash: 69411731B0E647E6FA959B21A84027823A0FF65FC1F585435DD1D4B298DF3CE8958338

Function 00007FF66B13B200 Relevance: 16.6, APIs: 11, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF66B13B261
TlsGetValue.KERNEL32(?,?,?,00007FF66B13A7B5), ref: 00007FF66B13B28A
GetLastError.KERNEL32(?,?,?,00007FF66B13A7B5), ref: 00007FF66B13B28F
LeaveCriticalSection.KERNEL32 ref: 00007FF66B13B2B7
free.MSVCRT ref: 00007FF66B13B2F7
DeleteCriticalSection.KERNEL32 ref: 00007FF66B13B31D
InitializeCriticalSection.KERNEL32 ref: 00007FF66B13B3B7

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorInitializeLastLeaveValuefree
String ID:
API String ID: 100439675-0
Opcode ID: 9330b5d3d040965e5f82546b1fb6f7cd28c845c6038d1d802dd6600f1cdd6889
Instruction ID: 2efcb5d3d11c240dd85896b17b5af8d61905ab7e8ddede34e17a478b260def5e
Opcode Fuzzy Hash: 9330b5d3d040965e5f82546b1fb6f7cd28c845c6038d1d802dd6600f1cdd6889
Instruction Fuzzy Hash: C3410B25A09A02D6FA55AB12E980379A3B4AF4DF99F484535CD0DCF2B4FE2CF9418704

Function 00007FF8A8E185E0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF8A8E186B5
abort.MSVCRT(?,?,?,?,?,?,00000000,?,?,?,?,?,00007FF8A8E221B5), ref: 00007FF8A8E186BB
RtlUnwindEx.KERNEL32 ref: 00007FF8A8E187D1

Strings

CCG!, xrefs: 00007FF8A8E186A8
CCG , xrefs: 00007FF8A8E1864E
CCG!, xrefs: 00007FF8A8E18609
CCG", xrefs: 00007FF8A8E18642

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: ExceptionRaiseUnwindabort
String ID: CCG $CCG!$CCG!$CCG"
API String ID: 4140830120-3707373406
Opcode ID: 8230580fa15a5b06a7bc249b48aa6b1323d7fde1a1b9ca23d651a8f55b12df56
Instruction ID: 8bdb49a38aaf06a0cc022a7b58f722a66f30d5f95a9cdae83ad39955377a655b
Opcode Fuzzy Hash: 8230580fa15a5b06a7bc249b48aa6b1323d7fde1a1b9ca23d651a8f55b12df56
Instruction Fuzzy Hash: 0251F232A09B80D2E7A08B25E4406ADB370F799BD8F504236EE9D13758DF3CD4A1C754

Function 00007FF66B13BB70 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF66B13BC45
abort.MSVCRT(?,?,?,?,?,?,00000000,?,?,?,?,?,00007FF66B15D335), ref: 00007FF66B13BC4B
RtlUnwindEx.KERNEL32 ref: 00007FF66B13BD61

Strings

CCG!, xrefs: 00007FF66B13BB99
CCG!, xrefs: 00007FF66B13BC38
CCG , xrefs: 00007FF66B13BBDE
CCG", xrefs: 00007FF66B13BBD2

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: ExceptionRaiseUnwindabort
String ID: CCG $CCG!$CCG!$CCG"
API String ID: 4140830120-3707373406
Opcode ID: dc6a7ee336f2ebe839d07885afb3059022dc8acf7e1b17539076f0da69c5fdc9
Instruction ID: bac2a38d8dde6b3222be6ca923695dd6f2f9ce645e2b7fce6121c91e250e92e4
Opcode Fuzzy Hash: dc6a7ee336f2ebe839d07885afb3059022dc8acf7e1b17539076f0da69c5fdc9
Instruction Fuzzy Hash: B851BF32A08B80D6E7708B15E4446AAB370F79DB98F544236EE8D57768EF3CD982C704

Function 00007FF66B142AB0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF66B142AC0
GetProcAddress.KERNEL32 ref: 00007FF66B142AD7
LoadLibraryW.KERNEL32 ref: 00007FF66B142AFF
GetProcAddress.KERNEL32 ref: 00007FF66B142B0F

Strings

msvcrt.dll, xrefs: 00007FF66B142AB9
rand_s, xrefs: 00007FF66B142ACD
SystemFunction036, xrefs: 00007FF66B142B05
advapi32.dll, xrefs: 00007FF66B142AF8

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: SystemFunction036$advapi32.dll$msvcrt.dll$rand_s
API String ID: 384173800-4041758303
Opcode ID: 1745268a0d4ef1f4bbb13a60266eae6d266f976300e20f96b737c0f73c86d016
Instruction ID: 292725e64c523750ecb0046c721ab6825161991f0c1f68ef444ea84920b21e2c
Opcode Fuzzy Hash: 1745268a0d4ef1f4bbb13a60266eae6d266f976300e20f96b737c0f73c86d016
Instruction Fuzzy Hash: EFF01D20E59A07E0E915AB53FE500B467F8BF4C798B840132C80DCB374DE2CE58AC744

Function 00007FF8A8E175E0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF8A8E176FB

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF8A8E17791
Mingw-w64 runtime failure:, xrefs: 00007FF8A8E17617
VirtualProtect failed with code 0x%x, xrefs: 00007FF8A8E1776E
Address %p has no image-section, xrefs: 00007FF8A8E17652, 00007FF8A8E177A5

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 110d1f2817ca0a2f40a06a6f85d1c1df25be8983fd5431927ac0d32dbc5fbf02
Instruction ID: 3025494cfff14ee96b7734aadb905189939bcba42f512873ee2e5e0c2fed3a6f
Opcode Fuzzy Hash: 110d1f2817ca0a2f40a06a6f85d1c1df25be8983fd5431927ac0d32dbc5fbf02
Instruction Fuzzy Hash: C951D172B0AB46E1EB109B21E8406A97760FF99BD4F444131EE4C07798EF3CE495C758

Function 00007FF66B13A970 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF66B13AA8B

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF66B13AAFE
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF66B13AB21
Mingw-w64 runtime failure:, xrefs: 00007FF66B13A9A7
Address %p has no image-section, xrefs: 00007FF66B13A9E2, 00007FF66B13AB35

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 870e53ec4fd15d85e393abec348360d81c4a0922adaaf5e308eb63bd176a8771
Instruction ID: b7a83dae0b8595af9ac640ef9ae41e58810992423eae425295274846b8e6e30d
Opcode Fuzzy Hash: 870e53ec4fd15d85e393abec348360d81c4a0922adaaf5e308eb63bd176a8771
Instruction Fuzzy Hash: 1D517172A18A46D2EA109B52E9416B9B7B4FF4DB98F444231DE4C8B3B4EE3CE945C740

Function 00007FF8A8E1A530 Relevance: 12.4, APIs: 8, Instructions: 355COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF8A8E1A7E5

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: 6455380b65f2535aa43ea52f4673dc818bd6c141cbea47eaf03f434f54f19436
Instruction ID: b2869d1fdab456062866914563f408e3bf1b5e1490a51f2b5c01938b3606e629
Opcode Fuzzy Hash: 6455380b65f2535aa43ea52f4673dc818bd6c141cbea47eaf03f434f54f19436
Instruction Fuzzy Hash: 97E196B2A0A142D6E7A48F25D14477937F2EB64B98F258235CB0D47788DB3CEC61CB64

Function 00007FF66B13DAB0 Relevance: 12.4, APIs: 8, Instructions: 355COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF66B13DD65

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: d2623296c75c8317225f068edeea6053287046020c41a073c712053802fb2e7c
Instruction ID: 27f6792bbde96fbf2fbfe456c6f97ba46dbc1c3460e032f44bcb4cda0be36f2f
Opcode Fuzzy Hash: d2623296c75c8317225f068edeea6053287046020c41a073c712053802fb2e7c
Instruction Fuzzy Hash: B1E172B2A54142D6E7648F25C140779BBF2EB5DB5CF258239CA098F698EE3DEC41CB40

Function 00007FF8A8E18900 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF8A8E18932
RaiseException.KERNEL32 ref: 00007FF8A8E18954
abort.MSVCRT(?,?,?,?,?,?,?,?,00007FF8A8E2210B,?,?,?,00007FF8A8E21E68), ref: 00007FF8A8E18980
RaiseException.KERNEL32 ref: 00007FF8A8E189C7

Strings

CCG", xrefs: 00007FF8A8E1894F
CCG", xrefs: 00007FF8A8E189C2
CCG , xrefs: 00007FF8A8E1892D

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: ExceptionRaise$abort
String ID: CCG $CCG"$CCG"
API String ID: 3325032505-1179968548
Opcode ID: b9ab3242cddfa2819dbf7b129e39ea8be360cfbf5f2922f88af2ec39a7d05918
Instruction ID: 01014b766623865315b3bae8e73a8e0f4b315870b13e0dc941fdb31478bb64a2
Opcode Fuzzy Hash: b9ab3242cddfa2819dbf7b129e39ea8be360cfbf5f2922f88af2ec39a7d05918
Instruction Fuzzy Hash: 22215133A29B8183E350CF65E4403A96761F7D9788F20A22AEE8D57764DF7DC1968700

Function 00007FF66B13BE90 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF66B13BEC2
RaiseException.KERNEL32 ref: 00007FF66B13BEE4
abort.MSVCRT(?,?,?,?,?,?,?,?,00007FF66B15D28B,?,?,?,00007FF66B15CFE8), ref: 00007FF66B13BF10
RaiseException.KERNEL32 ref: 00007FF66B13BF57

Strings

CCG", xrefs: 00007FF66B13BEDF
CCG", xrefs: 00007FF66B13BF52
CCG , xrefs: 00007FF66B13BEBD

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: ExceptionRaise$abort
String ID: CCG $CCG"$CCG"
API String ID: 3325032505-1179968548
Opcode ID: 1248136c8d12200e9146046813ce4688b5b53dd78843b57f567ca62a653446f1
Instruction ID: bb1cb7220c9587f78a9ee2a5fc3ee6f20970b1a703cd82f8c5600cfd2a6c1225
Opcode Fuzzy Hash: 1248136c8d12200e9146046813ce4688b5b53dd78843b57f567ca62a653446f1
Instruction Fuzzy Hash: FB214F33A24B80C7E3509B55E4403A96771F7D9B98F20A22AEA8D47764EF79C5928700

Function 00007FF8A8E1E8B0 Relevance: 11.5, APIs: 9, Instructions: 204COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF8A8E1E927
LeaveCriticalSection.KERNEL32 ref: 00007FF8A8E1E95D

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: CriticalLeaveSectionfree
String ID:
API String ID: 1679108487-0
Opcode ID: 7b1761280d93aba6bd9828b87403fc43a41322c0571729c98febacc7a93ccf4b
Instruction ID: b0fa0fef24c5ea5bee8df97e7a32db00b1eec02ea950ecd244bc3f7255ebe2b7
Opcode Fuzzy Hash: 7b1761280d93aba6bd9828b87403fc43a41322c0571729c98febacc7a93ccf4b
Instruction Fuzzy Hash: E4917C31E0BA43E5FBA4AB24E54127862A1FF24BC5F484531EA5E47794DF3CF4A18368

Function 00007FF66B141E30 Relevance: 11.5, APIs: 9, Instructions: 204COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF66B141EA7
LeaveCriticalSection.KERNEL32 ref: 00007FF66B141EDD

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: CriticalLeaveSectionfree
String ID:
API String ID: 1679108487-0
Opcode ID: 0ffc4c2345dfc38d41add92abfaa222bdc7b4f4d0a5a20904e84831802a9edec
Instruction ID: 5aa9d819193dd3099091b13f4bc36eff741cb7a7d74642975052ecac91852fd1
Opcode Fuzzy Hash: 0ffc4c2345dfc38d41add92abfaa222bdc7b4f4d0a5a20904e84831802a9edec
Instruction Fuzzy Hash: 89914C76E19A52E5EB159B16E640278A6B4BF4CB8CF484131D90DDF7B4DF3CA8A1C340

Function 00007FF66B155622 Relevance: 10.8, APIs: 6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF66B15565B
memset.MSVCRT ref: 00007FF66B15569B

Strings

basic_string::_M_create, xrefs: 00007FF66B1556AD, 00007FF66B15575A, 00007FF66B15580A, 00007FF66B1558BA, 00007FF66B15596A

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memset
String ID: basic_string::_M_create
API String ID: 2221118986-3122258987
Opcode ID: 6fb3b78d44d575d06320290487d7c5b6d8944fbd8d7e913079a0a899b754db29
Instruction ID: b52c47c48c15963384b0b5c06429ddbb76f24269a4c9e17f56cad349fffdbe29
Opcode Fuzzy Hash: 6fb3b78d44d575d06320290487d7c5b6d8944fbd8d7e913079a0a899b754db29
Instruction Fuzzy Hash: D78155B3A09681D5EB255F1AF9402B9A7A0A75D7D8F9C8130CF9D8B361DE3CD482C344

Function 00007FF8A8E177C0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 269memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,00007FF8A8F2BE34,?,?,?,?,00007FF8A8E0124D), ref: 00007FF8A8E179A3

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF8A8E17B24
Unknown pseudo relocation protocol version %d., xrefs: 00007FF8A8E17B46
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF8A8E17B3A

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: 0d2082d56b1e6919d6b97bf141ca3ed5546f33310e17f22b7cccea4572611024
Instruction ID: c693f62ea9a6a0fadab53123fd19d4e903285d626b0857c906f2b4cfa3ab75b8
Opcode Fuzzy Hash: 0d2082d56b1e6919d6b97bf141ca3ed5546f33310e17f22b7cccea4572611024
Instruction Fuzzy Hash: ECA18F72F1A553E1EB908B259C406796291EF64BE4F148231DD2D077DCEF3CE8628268

Function 00007FF66B1472B0 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B1472DA
memcmp.MSVCRT ref: 00007FF66B1472F8
memcmp.MSVCRT ref: 00007FF66B147396

Strings

basic_string::compare, xrefs: 00007FF66B14733D, 00007FF66B1473D5, 00007FF66B147465, 00007FF66B147515, 00007FF66B14752E
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF66B147344, 00007FF66B1473DC, 00007FF66B14746C, 00007FF66B14751C, 00007FF66B147535

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: 40729e93884535b739f7e03e0d0f79bb8e5f81659639c57613e4a2e71e60f780
Instruction ID: 3c0c12f7c2abda4f10e2d531aadeb00692cfa6896e427d44adbb640a1965efe5
Opcode Fuzzy Hash: 40729e93884535b739f7e03e0d0f79bb8e5f81659639c57613e4a2e71e60f780
Instruction Fuzzy Hash: 2651A492F08552E1EE149A26E9041F492659F1EBECF5C5A32DE2CDF7F1DD1CEA828300

Function 00007FF66B1487F0 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B148819
memcmp.MSVCRT ref: 00007FF66B14883A
memcmp.MSVCRT ref: 00007FF66B1488D6

Strings

basic_string::compare, xrefs: 00007FF66B14887D, 00007FF66B148915, 00007FF66B1489A5, 00007FF66B148A55, 00007FF66B148A6E
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF66B148884, 00007FF66B14891C, 00007FF66B1489AC, 00007FF66B148A5C, 00007FF66B148A75

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: 556757704265cff6b1fb931cde587f6bb9eb8c88f18b4d56dd346ebeeb61897e
Instruction ID: fc72457c7eaf152a98471df96dfb4dcf00bba3b737e8b48edf75cf091a18e312
Opcode Fuzzy Hash: 556757704265cff6b1fb931cde587f6bb9eb8c88f18b4d56dd346ebeeb61897e
Instruction Fuzzy Hash: DE51E292B18543E2EE149A26ED101F492649F4DBECF684631ED2CDF7F6DE1CE9868300

Function 00007FF66B146010 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 109windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF66B14604B
LocalFree.KERNEL32 ref: 00007FF66B146098
memcpy.MSVCRT ref: 00007FF66B146105

Strings

Unknown , xrefs: 00007FF66B14611F
error co, xrefs: 00007FF66B14612C
basic_string: construction from null is not valid, xrefs: 00007FF66B1461C7

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: FormatFreeLocalMessagememcpy
String ID: Unknown $basic_string: construction from null is not valid$error co
API String ID: 1463094090-4228307607
Opcode ID: 3a9fb73336347df441dc2766997908fab837d92f5451a5c1a35b54809c4278da
Instruction ID: 8dbd8262c9641da00ffd8117dac11363e320b0df022ea3aa8ffdddb7f354777a
Opcode Fuzzy Hash: 3a9fb73336347df441dc2766997908fab837d92f5451a5c1a35b54809c4278da
Instruction Fuzzy Hash: 64415772A09B45D1EB158F19E45036DB6B4EB8AFDCF548031DA8C8BBA9EF3CD4568700

Function 00007FF66B123440 Relevance: 10.6, APIs: 7, Instructions: 82stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF66B123500
strcpy_s.MSVCRT ref: 00007FF66B123516
strcpy_s.MSVCRT ref: 00007FF66B123524
strcpy_s.MSVCRT ref: 00007FF66B123532
_strlwr.MSVCRT ref: 00007FF66B123538
_strlwr.MSVCRT ref: 00007FF66B123541
strstr.MSVCRT ref: 00007FF66B12354D

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: strcpy_s$_strlwr$ByteCharMultiWidestrstr
String ID:
API String ID: 606828236-0
Opcode ID: 41aca9e7587885c8d3749f665e5191286f25816fd95446d896fc951d524c147b
Instruction ID: ab12b792e78972705a6b05b681e067de2f94ff135e3b4cf4ea445cee15adf208
Opcode Fuzzy Hash: 41aca9e7587885c8d3749f665e5191286f25816fd95446d896fc951d524c147b
Instruction Fuzzy Hash: B531BF72604685D6EB209B16F9447AAA7A1F78EBD8F440031DF5D5BBA4CF3CC446D300

Function 00007FF66B1231E0 Relevance: 10.6, APIs: 7, Instructions: 82stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF66B1232A0
strcpy_s.MSVCRT ref: 00007FF66B1232B6
strcpy_s.MSVCRT ref: 00007FF66B1232C4
strcpy_s.MSVCRT ref: 00007FF66B1232D2
_strlwr.MSVCRT ref: 00007FF66B1232D8
_strlwr.MSVCRT ref: 00007FF66B1232E1
strstr.MSVCRT ref: 00007FF66B1232ED

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: strcpy_s$_strlwr$ByteCharMultiWidestrstr
String ID:
API String ID: 606828236-0
Opcode ID: 4ed06ea6b6a309e14091867f3927c9325d9ceeb3de57b30392eac0086e627436
Instruction ID: 5e300234826f841e044313bafe7567dceb0bf576ff6a86c5a34bc5c49deeb4ed
Opcode Fuzzy Hash: 4ed06ea6b6a309e14091867f3927c9325d9ceeb3de57b30392eac0086e627436
Instruction Fuzzy Hash: F2318F72204685D6EB209B16F9547AAA7A1F78EBD8F480131DF9D5BB94CF3CD446D300

Function 00007FF8A8E19070 Relevance: 9.4, APIs: 6, Instructions: 414COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF8A8E191F2
fputc.MSVCRT ref: 00007FF8A8E1926A
fputc.MSVCRT ref: 00007FF8A8E192C2

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: 67e0c1fe5ae666fd804cf944b37e3220ac5a14e8281472bc3b8760f1b714fa65
Instruction ID: f29c60ca0cd52b97217dd768ef92cf882994386d72e2387089559a436cd57de3
Opcode Fuzzy Hash: 67e0c1fe5ae666fd804cf944b37e3220ac5a14e8281472bc3b8760f1b714fa65
Instruction Fuzzy Hash: BCF1E472E1A181D6EBE09F3590447796A91FB24BE8F948230CA1E57BC4CB3CED51C728

Function 00007FF66B13C5F0 Relevance: 9.4, APIs: 6, Instructions: 414COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF66B13C772
fputc.MSVCRT ref: 00007FF66B13C7EA
fputc.MSVCRT ref: 00007FF66B13C842

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: 5a2601bb742be21d7d0ed194e9666a6ba37078df609cf0cda1f1cf3f5c2d7d2e
Instruction ID: f513df84bcf087378fe66d7ae56730be8d55aaca2e89ac3efc3e0f250505fa4c
Opcode Fuzzy Hash: 5a2601bb742be21d7d0ed194e9666a6ba37078df609cf0cda1f1cf3f5c2d7d2e
Instruction Fuzzy Hash: E1F1D772E18361E6E7618E359004739AAB1AB18BACF658235CD1D9F7E4EF3CED418740

Function 00007FF66B15A650 Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 325COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF66B15A67F
memset.MSVCRT ref: 00007FF66B15A6C3

Strings

basic_string::_M_create, xrefs: 00007FF66B15A6E4, 00007FF66B15A79A, 00007FF66B15A84A, 00007FF66B15A8FA

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memset
String ID: basic_string::_M_create
API String ID: 2221118986-3122258987
Opcode ID: 3b3aa6573da6e4dfb28d73fa6c8f3d38db798b1ac3f3d9961a4e1d9ac56c9cad
Instruction ID: 82e5ca6acc1310708f2f51b901bff198258bd18f55dcf2e8d60665f9626377b6
Opcode Fuzzy Hash: 3b3aa6573da6e4dfb28d73fa6c8f3d38db798b1ac3f3d9961a4e1d9ac56c9cad
Instruction Fuzzy Hash: 9AA181B3618B81D5EB268F15F8403ADA7B0E759798F588135CBAD8B3A5DE3CD582C310

Function 00007FF66B151830 Relevance: 9.3, APIs: 4, Strings: 2, Instructions: 312COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF66B1518C2

Strings

basic_string::_S_construct null not valid, xrefs: 00007FF66B151B22, 00007FF66B151C32
basic_string::_S_create, xrefs: 00007FF66B15190F, 00007FF66B151A06, 00007FF66B151B16, 00007FF66B151C26

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memset
String ID: basic_string::_S_construct null not valid$basic_string::_S_create
API String ID: 2221118986-1585226940
Opcode ID: c8d5f8e8a89f42e7d8945c1179f06e3fdab881b1ee5ca00826c05ceb22cecc83
Instruction ID: c1ef16dbdf3723167f8430b42058164b05ba6564a9a674cfefe72b1608d355fd
Opcode Fuzzy Hash: c8d5f8e8a89f42e7d8945c1179f06e3fdab881b1ee5ca00826c05ceb22cecc83
Instruction Fuzzy Hash: 72B103B3B05651E5EA159F11E8402B8A7B0EB9D7B8F884335DA6C8B3E1EE38D591C344

Function 00007FF66B150AB0 Relevance: 9.3, APIs: 4, Strings: 2, Instructions: 298COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF66B150B42

Strings

basic_string::_S_construct null not valid, xrefs: 00007FF66B150DA2, 00007FF66B150EB2
basic_string::_S_create, xrefs: 00007FF66B150B8F, 00007FF66B150C86, 00007FF66B150D96, 00007FF66B150EA6

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memset
String ID: basic_string::_S_construct null not valid$basic_string::_S_create
API String ID: 2221118986-1585226940
Opcode ID: 856fa6a36e0673ce7f4e18f75243ee1c9891fbe335259abfa13c610739b481cf
Instruction ID: 55fb7301a764133d03936775872f4b00e7eca235dd0ad190a7d1c3e3bea05d1f
Opcode Fuzzy Hash: 856fa6a36e0673ce7f4e18f75243ee1c9891fbe335259abfa13c610739b481cf
Instruction Fuzzy Hash: B2A1C0B3B05641E5EA159F11E8442B8A7A0EB5D7B8F884335DE6C8B3E1EE38D5C5C344

Function 00007FF66B15B170 Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF66B15B19F
memset.MSVCRT ref: 00007FF66B15B1E3

Strings

basic_string::_M_create, xrefs: 00007FF66B15B204, 00007FF66B15B2BA, 00007FF66B15B36A, 00007FF66B15B41A

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memset
String ID: basic_string::_M_create
API String ID: 2221118986-3122258987
Opcode ID: c1b6af8333b08662b2e041b5ee1645650fe8d0ee36ac4207bcac4ce8e436d6ee
Instruction ID: e76e7171795ee7ed019eccb9d8e949c3229e29bbb6a3813028383718e519decb
Opcode Fuzzy Hash: c1b6af8333b08662b2e041b5ee1645650fe8d0ee36ac4207bcac4ce8e436d6ee
Instruction Fuzzy Hash: EE71A5B3A09781D1EB659F25F8403BDE6A0A75D798F588134CB9D8B7A1DE3CD582C300

Function 00007FF66B15B550 Relevance: 9.3, APIs: 4, Strings: 2, Instructions: 263stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B15B560
memcpy.MSVCRT ref: 00007FF66B15B5A9

Strings

basic_string::_M_replace, xrefs: 00007FF66B15B62A, 00007FF66B15B82B
basic_string::_M_create, xrefs: 00007FF66B15B74C

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_create$basic_string::_M_replace
API String ID: 3412268980-3182797996
Opcode ID: a4a77f29458f9cb154a29deae139d1e9492526cb708b50eedfc3ffab9e8559ba
Instruction ID: a4065135ab7b25bffe7152ecf670eafcc46e7ea81d48a903051e563c6c6479f6
Opcode Fuzzy Hash: a4a77f29458f9cb154a29deae139d1e9492526cb708b50eedfc3ffab9e8559ba
Instruction Fuzzy Hash: 5E91A1B3B09A55E4EA109E26D4102BAA375AB49FDCF588531DE0D8F7E5DE2CE482C344

Function 00007FF8A8E1F820 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

___mb_cur_max_func.MSVCRT ref: 00007FF8A8E1F84B
___lc_codepage_func.MSVCRT ref: 00007FF8A8E1F853
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF8A8E1F8A3
MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E1F8D5

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func
String ID:
API String ID: 2785433807-0
Opcode ID: 045a4edea1dc10e642a560aad34acbd731cf3aed7047957cde1b25f54302cde7
Instruction ID: 8bf23703fd0e91ffcfa27104ec994680dcc415eda0e3be6fde67e9f91d62b030
Opcode Fuzzy Hash: 045a4edea1dc10e642a560aad34acbd731cf3aed7047957cde1b25f54302cde7
Instruction Fuzzy Hash: 49312933A0E202A9E7929B21B4003B96654EB657F8F484236EEAD477C0DF7CC191C754

Function 00007FF66B142D40 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

___mb_cur_max_func.MSVCRT ref: 00007FF66B142D6B
___lc_codepage_func.MSVCRT ref: 00007FF66B142D73
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF66B142DC3
MultiByteToWideChar.KERNEL32 ref: 00007FF66B142DF5

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func
String ID:
API String ID: 2785433807-0
Opcode ID: 76b1e90f5653ac1efe6e01a3497f5a7dcbdac358d6369edad7d790266bddad3a
Instruction ID: 76c067db9c55cb0735e9876d9dc130d0f8ef1905129ffd1a9948320acd2001a9
Opcode Fuzzy Hash: 76b1e90f5653ac1efe6e01a3497f5a7dcbdac358d6369edad7d790266bddad3a
Instruction Fuzzy Hash: 5A311923B18201D9F7624B21E9003B9A5B46B597ACF484236EE6DDB7E0DE7DC482C740

Function 00007FF8A8E1FE30 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

___mb_cur_max_func.MSVCRT ref: 00007FF8A8E1FE4A
___lc_codepage_func.MSVCRT ref: 00007FF8A8E1FE52
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF8A8E1FE9C
MultiByteToWideChar.KERNEL32 ref: 00007FF8A8E1FED2

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func
String ID:
API String ID: 2785433807-0
Opcode ID: f64dfb8e97fed0c24a6908fc68c6d82c6f513f64860be90f5e13696cf9485a37
Instruction ID: 22792e3c9fd8ef3b9334d469a6009bddc3c9f5f4b1a4ce61c2d8b8cf43819508
Opcode Fuzzy Hash: f64dfb8e97fed0c24a6908fc68c6d82c6f513f64860be90f5e13696cf9485a37
Instruction Fuzzy Hash: 7E312832B1E202A5FBA14B21A4003BD6690EB557F4F440235EEAD477D5EFBCD454C758

Function 00007FF66B143350 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

___mb_cur_max_func.MSVCRT ref: 00007FF66B14336A
___lc_codepage_func.MSVCRT ref: 00007FF66B143372
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF66B1433BC
MultiByteToWideChar.KERNEL32 ref: 00007FF66B1433F2

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func
String ID:
API String ID: 2785433807-0
Opcode ID: 53341a738e5cadae43da478427d4a0a68b5e323042c8c57fb093b523a33c8061
Instruction ID: db2894bbaa5ff3ee2318063def28173b63bb6626ecc4cba238ea59d8b04bec66
Opcode Fuzzy Hash: 53341a738e5cadae43da478427d4a0a68b5e323042c8c57fb093b523a33c8061
Instruction Fuzzy Hash: 61311262B0D601E5EB625B21B4003B9A6B0AB497BCF484634EE6D8B7E5EE7DD4468700

Function 00007FF66B121550 Relevance: 9.1, APIs: 6, Instructions: 82stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF66B121610
strcpy_s.MSVCRT ref: 00007FF66B121626
strcpy_s.MSVCRT ref: 00007FF66B121634
strcpy_s.MSVCRT ref: 00007FF66B121642
_strlwr.MSVCRT ref: 00007FF66B121648
_strlwr.MSVCRT ref: 00007FF66B121651

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: strcpy_s$_strlwr$ByteCharMultiWide
String ID:
API String ID: 2752519838-0
Opcode ID: d3238b2c8870ec8a07ec28956ea3111573fca0877216f30c58544a9a3c261ed9
Instruction ID: 9b100c259918a5d7227a539528da49ecbccab8d8c3cad8eaf077f0318f0f1e78
Opcode Fuzzy Hash: d3238b2c8870ec8a07ec28956ea3111573fca0877216f30c58544a9a3c261ed9
Instruction Fuzzy Hash: DE31AE72204685D2EB209F16F9547AAA7A1F78EBD8F490131DF5D5BB94CE3DC056D300

Function 00007FF66B146210 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

strerror.MSVCRT ref: 00007FF66B14621E
strlen.MSVCRT ref: 00007FF66B146239
memcpy.MSVCRT ref: 00007FF66B1462A8

Strings

__gnu_cxx::__concurrence_lock_error, xrefs: 00007FF66B1462D0
basic_string: construction from null is not valid, xrefs: 00007FF66B1462B7

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpystrerrorstrlen
String ID: __gnu_cxx::__concurrence_lock_error$basic_string: construction from null is not valid
API String ID: 2955597728-1066207237
Opcode ID: 6c05f484a9941a8194b6d0dce824dbc127c943f08ce635f713085ef5fd9f7352
Instruction ID: 332e50473a5ecfdbc4149743e45b7d8373aff0e6d15df25b4b7f611ccdd4a816
Opcode Fuzzy Hash: 6c05f484a9941a8194b6d0dce824dbc127c943f08ce635f713085ef5fd9f7352
Instruction Fuzzy Hash: DD11B222709B55E8EE209B26A810578B7B4EB4EBDCF484570DE4D8F7A5EE3CE151C300

Function 00007FF8A8E196F0 Relevance: 7.8, APIs: 5, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9144cf1045d7e2c903a37bdb67ff89c02f36cefd9ce95b033c499c81022daf61
Instruction ID: fb0eeb7b64067fb890ead4fd6b35ed90c6a60d085017e329fca13d29070abaf7
Opcode Fuzzy Hash: 9144cf1045d7e2c903a37bdb67ff89c02f36cefd9ce95b033c499c81022daf61
Instruction Fuzzy Hash: F1C192B3E0A652D6E7A59F29C00037977A1EB64B98F998235CE0D17385CB3CEC51C768

Function 00007FF66B13CC70 Relevance: 7.8, APIs: 5, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a67022de2d0f3e7fbb5a2b5da87f3078e3fa5e55b14ba386eecbdd5a6595ed1
Instruction ID: 05dad10c3d86397fc542a829e5ff9735b33668a526afcb2bdbe3b6884298b37e
Opcode Fuzzy Hash: 2a67022de2d0f3e7fbb5a2b5da87f3078e3fa5e55b14ba386eecbdd5a6595ed1
Instruction Fuzzy Hash: F7C15E77E08662D6E7658F29C004379AAB1EB48B5CF598235DA0C9B394EE3DEC51C780

Function 00007FF66B14AB00 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 246COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF66B14AB80
memcpy.MSVCRT ref: 00007FF66B14AC68

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF66B14ABEE
basic_string::append, xrefs: 00007FF66B14ABE7, 00007FF66B14AD02, 00007FF66B14ADD8

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::append
API String ID: 3510742995-4063909124
Opcode ID: bae0ff218b20670b4f9987ca9e8520b6ae406f4ee6c6b5e5c540c6788cd2ccc3
Instruction ID: 179c28f8e1fa1ec4012d8223c35b8ea9e3fadc6b0a977a3c64f69812ba6965b0
Opcode Fuzzy Hash: bae0ff218b20670b4f9987ca9e8520b6ae406f4ee6c6b5e5c540c6788cd2ccc3
Instruction Fuzzy Hash: 55919C72B1AA46E5EE108F1AD54467DA772AB48FCCF598031CB1D8F7A5DE3DE8808340

Function 00007FF66B14A810 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 217stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B14A821
memcpy.MSVCRT ref: 00007FF66B14A87C

Part of subcall function 00007FF66B14FA40: memcpy.MSVCRT ref: 00007FF66B14FB20

memcpy.MSVCRT ref: 00007FF66B14A984

Strings

basic_string::append, xrefs: 00007FF66B14A912, 00007FF66B14AA22

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy$strlen
String ID: basic_string::append
API String ID: 2619041689-3811946249
Opcode ID: 963b785b52e3224a4072d1896626a27c21cd27bff83fb5cefabdb1913e31edc1
Instruction ID: 7ebad2fd67ca8e29887b002b9e2d62244ac44a473ec2a070b50973047aaa614b
Opcode Fuzzy Hash: 963b785b52e3224a4072d1896626a27c21cd27bff83fb5cefabdb1913e31edc1
Instruction Fuzzy Hash: D381AF62B5A646E4EE108F1AD54827DA771AB4DFDCF698431CB0DCF3A5DE2CE8858340

Function 00007FF66B150180 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 156stringCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF66B15020E
strlen.MSVCRT ref: 00007FF66B15019C

Part of subcall function 00007FF66B15CDA0: malloc.MSVCRT ref: 00007FF66B15CDB7

memcpy.MSVCRT ref: 00007FF66B150315

Strings

basic_string::_S_construct null not valid, xrefs: 00007FF66B150276, 00007FF66B150389
basic_string::_S_create, xrefs: 00007FF66B150282, 00007FF66B15037D

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy$mallocstrlen
String ID: basic_string::_S_construct null not valid$basic_string::_S_create
API String ID: 2479879881-1585226940
Opcode ID: 554ecd67c1abac83849725017e970529447c28235929fdc350b9f3b540b863a0
Instruction ID: a6c247ec732c602446a0a876b24f1687f2989207301b74087e54364c9737e5d5
Opcode Fuzzy Hash: 554ecd67c1abac83849725017e970529447c28235929fdc350b9f3b540b863a0
Instruction Fuzzy Hash: 1B5109B3B05741E5EA559F51E8442B86770AB5D7A8F484335DA2C8B3E1EE38D584C344

Function 00007FF66B150F00 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 156stringCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF66B150F8E
strlen.MSVCRT ref: 00007FF66B150F1C

Part of subcall function 00007FF66B15CDA0: malloc.MSVCRT ref: 00007FF66B15CDB7

memcpy.MSVCRT ref: 00007FF66B151095

Strings

basic_string::_S_construct null not valid, xrefs: 00007FF66B150FF6, 00007FF66B151109
basic_string::_S_create, xrefs: 00007FF66B151002, 00007FF66B1510FD

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy$mallocstrlen
String ID: basic_string::_S_construct null not valid$basic_string::_S_create
API String ID: 2479879881-1585226940
Opcode ID: 799c117cadb114e0cd1e209efa8e7f7343c02a9fbbefa7cf9b5750e4b2bf7628
Instruction ID: 67cb5a681c514c6efd95a26ba69a192af7a3c20581a9656b303c4d05bbb10909
Opcode Fuzzy Hash: 799c117cadb114e0cd1e209efa8e7f7343c02a9fbbefa7cf9b5750e4b2bf7628
Instruction Fuzzy Hash: F75101B3B05641E5EA159F11E8412B8A7B0AB5D7A8F884336DA2C8B3E1EE38D595C344

Function 00007FF66B14F50D Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF66B14F66A
memcpy.MSVCRT ref: 00007FF66B14F696
memset.MSVCRT ref: 00007FF66B14F6EE

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF66B14F537, 00007FF66B14F559
basic_string::replace, xrefs: 00007FF66B14F530, 00007FF66B14F543, 00007FF66B14F552

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy$memset
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::replace
API String ID: 438689982-3564965661
Opcode ID: 7d07a84816c15cc56eaba313950e72f344c81b4d8b92c2b981b4ed5c8b14885f
Instruction ID: a8b25539e974f434f75f4cd4c67aac3a852a26a95e115fa9b532e5607ec25dfa
Opcode Fuzzy Hash: 7d07a84816c15cc56eaba313950e72f344c81b4d8b92c2b981b4ed5c8b14885f
Instruction Fuzzy Hash: A641C062B09606E0EA10DF12E9085B9A7B5AB09BDCF494235DE2C8F7F5EE3CD445C340

Function 00007FF66B15AB30 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 137stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B15AB4D
memcpy.MSVCRT ref: 00007FF66B15ABB2

Strings

basic_string: construction from null is not valid, xrefs: 00007FF66B15ABC8, 00007FF66B15AC96
basic_string::_M_create, xrefs: 00007FF66B15ABBC, 00007FF66B15AC8A

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string: construction from null is not valid$basic_string::_M_create
API String ID: 3412268980-1223694479
Opcode ID: 33f34316dcfcb00a88ce46ae8247a67b665a3a4c540612f88c56f9aee88c4380
Instruction ID: f763dd376fc5049c3ab26b25d45a66e1eaebabd800b91753f9aaeea1ee9940c8
Opcode Fuzzy Hash: 33f34316dcfcb00a88ce46ae8247a67b665a3a4c540612f88c56f9aee88c4380
Instruction Fuzzy Hash: EE41B6B3A19741E5EB259F15F8502B8A770AB1D798F588430CA8D8F3B1DF2CE581C354

Function 00007FF66B15A010 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 137stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B15A02D
memcpy.MSVCRT ref: 00007FF66B15A092

Strings

basic_string: construction from null is not valid, xrefs: 00007FF66B15A0A8, 00007FF66B15A176
basic_string::_M_create, xrefs: 00007FF66B15A09C, 00007FF66B15A16A

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string: construction from null is not valid$basic_string::_M_create
API String ID: 3412268980-1223694479
Opcode ID: 54370014f0e531c2355f09a1a9b873e1d7a6c59404df1bbe8d732e8d5f95961d
Instruction ID: d52fd475727689457c7cb5da3d6337ad0e9ec2269a5b4793387661ffe59afc72
Opcode Fuzzy Hash: 54370014f0e531c2355f09a1a9b873e1d7a6c59404df1bbe8d732e8d5f95961d
Instruction Fuzzy Hash: D841B6B3A59741E5EA259F15F8402B9A7B0AB1D788F588430CB8C8F3A1EF2CE441C320

Function 00007FF66B124BF0 Relevance: 7.5, APIs: 6, Instructions: 47stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF66B124C26
strcmp.MSVCRT ref: 00007FF66B124C37
strcmp.MSVCRT ref: 00007FF66B124C48
strcmp.MSVCRT ref: 00007FF66B124C59
strcmp.MSVCRT ref: 00007FF66B124C6A
strcmp.MSVCRT ref: 00007FF66B124C7B

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 94ad545dae639b27e3a0ec693e3b2c71b4b28bc3dff286f18749c0c7a483bde3
Instruction ID: d5d3f764def1cb2a47ffb6c6cd8db592cfa15cc3a2f95c5680982ea01c8633b6
Opcode Fuzzy Hash: 94ad545dae639b27e3a0ec693e3b2c71b4b28bc3dff286f18749c0c7a483bde3
Instruction Fuzzy Hash: DE116025A18682E2FA50DB36A900175A3B4AF4E77CF880330DD2CCA3E5DF2CE045CA50

Function 00007FF66B13AB50 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 250memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00007FF66B29C070,00007FF66B29C078,00007FF66B29C0C0,?,?,?,?,00000001,00007FF66B121244), ref: 00007FF66B13AD33

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF66B13AEB4
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF66B13AECA
Unknown pseudo relocation protocol version %d., xrefs: 00007FF66B13AED6

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: d644f1b17d69f2222a926afcd44368b5454c7434d6573c80e9616fa1b88e8379
Instruction ID: 2e09f51ee3287ee1ed4587e24e27477b5caad10357697d3a6ced913a9da7a4f5
Opcode Fuzzy Hash: d644f1b17d69f2222a926afcd44368b5454c7434d6573c80e9616fa1b88e8379
Instruction Fuzzy Hash: 0991A122E69912D6FE109B15D54067DA6B1BF58B6CF148231CA1D9B7F8FE2CEC428340

Function 00007FF8A8E17240 Relevance: 6.3, APIs: 5, Instructions: 96stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8A8E172C5
memcpy.MSVCRT ref: 00007FF8A8E172DE
free.MSVCRT ref: 00007FF8A8E172E9

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: 54317f0fdeac30bcebbf66fa6848f9a36ed90ca35f5092cf1ed1f2acbf0d2b7e
Instruction ID: 71555ed554b5e3753e953e8b61a2cdbe3fb4a089bff0b6a9fd20c71b00e6f1fc
Opcode Fuzzy Hash: 54317f0fdeac30bcebbf66fa6848f9a36ed90ca35f5092cf1ed1f2acbf0d2b7e
Instruction Fuzzy Hash: 3D31B672F5F642E1FAE65A115A007799291EF61FE0F18C230ED5E0BBC8EF3C95518268

Function 00007FF66B13A4B0 Relevance: 6.3, APIs: 5, Instructions: 96stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B13A535
memcpy.MSVCRT ref: 00007FF66B13A54E
free.MSVCRT ref: 00007FF66B13A559

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: eb478e015de125fec45cee6dfef5f4baf1e013d62876e060b493f32fb256c3ff
Instruction ID: 66f39e29018f1c69c1d6b7bc2fb83531158e7d895f9c8646f45a25b4e3dc2cef
Opcode Fuzzy Hash: eb478e015de125fec45cee6dfef5f4baf1e013d62876e060b493f32fb256c3ff
Instruction Fuzzy Hash: 3E319622B69642E5FD665A15660037DE2706F4A7ECF188230DD5D8FBE4FE2CEC418A00

Function 00007FF8A8E07AC8 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8A8E07C54

Strings

t, xrefs: 00007FF8A8E119DA
ty, xrefs: 00007FF8A8E07BBE
y, xrefs: 00007FF8A8E119FC

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: strlen
String ID: t$ty$y
API String ID: 39653677-1920740250
Opcode ID: 1f09ed407c13002dfa1e0e99d8ff24085821c5c02fbe4f82a017bcf01e28625f
Instruction ID: 92e40fcfe711b6a8542dc1ae43512158666fa58c0d7659ef431303243ec1c348
Opcode Fuzzy Hash: 1f09ed407c13002dfa1e0e99d8ff24085821c5c02fbe4f82a017bcf01e28625f
Instruction Fuzzy Hash: A9E119729487C2C6E7568F38C4143E93AA1EB29F4CF0C8135CB890B799DBBE94959335

Function 00007FF66B12AD38 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B12AEC4

Strings

t, xrefs: 00007FF66B134C4A
y, xrefs: 00007FF66B134C6C
ty, xrefs: 00007FF66B12AE2E

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: strlen
String ID: t$ty$y
API String ID: 39653677-1920740250
Opcode ID: 55d3499485f9fdf290709b93709e1016a098a97d78733147dfbd427856e74433
Instruction ID: 0441cbfd97305493b479c909dc8193ca505f2895cf57c19f42e1703d9548ed11
Opcode Fuzzy Hash: 55d3499485f9fdf290709b93709e1016a098a97d78733147dfbd427856e74433
Instruction Fuzzy Hash: 96E1E9725087C2C6E7568F38C0143E96BA1EB29F4CF088135CB894F799DBBE94999361

Function 00007FF8A8E09E6C Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A8E09EDC
strcmp.MSVCRT ref: 00007FF8A8E09F19

Strings

(, xrefs: 00007FF8A8E11185

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: strcmp
String ID: (
API String ID: 1004003707-3887548279
Opcode ID: 71b49b42071fcab31e59767bd9d2f554238ba271c372a57ce5eb92790965ba50
Instruction ID: f7abf6b01af5fdb9ba751de9733aff42e90a771b483f90fdad50255222814ca6
Opcode Fuzzy Hash: 71b49b42071fcab31e59767bd9d2f554238ba271c372a57ce5eb92790965ba50
Instruction Fuzzy Hash: 0DA19B72A48786D1EB559F25D8003E927A1EB65FC8F488432CF4E0B78ADF7DD8908364

Function 00007FF66B12D0DC Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF66B12D14C
strcmp.MSVCRT ref: 00007FF66B12D189

Strings

(, xrefs: 00007FF66B1343F5

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: strcmp
String ID: (
API String ID: 1004003707-3887548279
Opcode ID: 206025e6fb96563ac5ff7dd0aedf3cef1b59fb9acac3525ec18d4ee8eb5ef659
Instruction ID: 27cb03820f9fcd3168c75a6ac237c0d42428e59dfc1eef7ec10404daf0ccb528
Opcode Fuzzy Hash: 206025e6fb96563ac5ff7dd0aedf3cef1b59fb9acac3525ec18d4ee8eb5ef659
Instruction Fuzzy Hash: D3A17C72608786D2EB559F25D4043E967A1EB5AF88F484032CF4D8F7AADF7DD8848360

Function 00007FF8A8E08E00 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 205stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8A8E0D463

Strings

a, xrefs: 00007FF8A8E12072
rm, xrefs: 00007FF8A8E12086
a, xrefs: 00007FF8A8E1206D

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: strlen
String ID: a$a$rm
API String ID: 39653677-3573517395
Opcode ID: 751185ab040397dca735e97abe02af4769e22594ee0fc5d9bdc7d1c024764b9f
Instruction ID: 1dff3900a2f7aa74067a94fa0054409d78bff9d4aac84769d8074511878ea10e
Opcode Fuzzy Hash: 751185ab040397dca735e97abe02af4769e22594ee0fc5d9bdc7d1c024764b9f
Instruction Fuzzy Hash: D4B130729497C2C5E7568F28C0143EC2AA1EB25F8CF1C8135CB880F799DBBE94969335

Function 00007FF66B12C070 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 205stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B1306D3

Strings

rm, xrefs: 00007FF66B1352F6
a, xrefs: 00007FF66B1352DD
a, xrefs: 00007FF66B1352E2

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: strlen
String ID: a$a$rm
API String ID: 39653677-3573517395
Opcode ID: caae019ee8604bc8c2d17cb176cd6b377816d5162eeb6dcc3b606f3ac53e98ef
Instruction ID: 674bfc01e7119c273718091cbbf8e1be0f7fc199963c78fecafe88b87f505184
Opcode Fuzzy Hash: caae019ee8604bc8c2d17cb176cd6b377816d5162eeb6dcc3b606f3ac53e98ef
Instruction Fuzzy Hash: A7B12F725087C2C5E7568F28C0183E97AA1EB19F4CF1C8135CB894F7A9DFBE94869361

Function 00007FF66B14D310 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 167COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF66B14D3BC

Strings

basic_string::resize, xrefs: 00007FF66B14D405, 00007FF66B14D515
basic_string::append, xrefs: 00007FF66B14D411, 00007FF66B14D521

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memset
String ID: basic_string::append$basic_string::resize
API String ID: 2221118986-1480708123
Opcode ID: be85ff7a44ff206d8dacc3031ad4ecaabb8953c129e7e317a0bf99caae06ed63
Instruction ID: 6434561f8babb17ff5cb0b3f7cb379427bf3cb9ec8e5f829849f9840e71d4d96
Opcode Fuzzy Hash: be85ff7a44ff206d8dacc3031ad4ecaabb8953c129e7e317a0bf99caae06ed63
Instruction Fuzzy Hash: 7E51A2A2B89542E0FF208E1AA5441BDA2B19B8DBDCF584531CB1DCF7E5DE2CED818340

Function 00007FF66B148E70 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF66B148EF3
memcpy.MSVCRT ref: 00007FF66B148FF3

Part of subcall function 00007FF66B15CDA0: malloc.MSVCRT ref: 00007FF66B15CDB7

Strings

basic_string::_S_construct null not valid, xrefs: 00007FF66B148F5F, 00007FF66B14905F
basic_string::_S_create, xrefs: 00007FF66B148F53, 00007FF66B149053

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy$malloc
String ID: basic_string::_S_construct null not valid$basic_string::_S_create
API String ID: 962570267-1585226940
Opcode ID: ea3f7254ee7aa76e44d378e4ffd69edda541cb38aa15042a431b8fe1b176fe52
Instruction ID: eacd1c13190643aa98f6e77c05f66ed8b0e23b932b2b923cdd3ed72775080964
Opcode Fuzzy Hash: ea3f7254ee7aa76e44d378e4ffd69edda541cb38aa15042a431b8fe1b176fe52
Instruction Fuzzy Hash: 2841F673B05241E9EA159F15E9502F8A7649B9C7BCF880631DA2C8B3E2EE3CD5C1C380

Function 00007FF66B1524F0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B152501
memcpy.MSVCRT ref: 00007FF66B15255C

Part of subcall function 00007FF66B14FA40: memcpy.MSVCRT ref: 00007FF66B14FB20

memcpy.MSVCRT ref: 00007FF66B152664

Strings

basic_string::append, xrefs: 00007FF66B1525F2

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy$strlen
String ID: basic_string::append
API String ID: 2619041689-3811946249
Opcode ID: baa949025936676ce1b05a541b5126b0a64c21229275e6a25e995d509b6819c0
Instruction ID: a7123b3b0f9e8d5cbac6fbf6c4c44961c09a6f8ec274820c5c99f871251a665b
Opcode Fuzzy Hash: baa949025936676ce1b05a541b5126b0a64c21229275e6a25e995d509b6819c0
Instruction Fuzzy Hash: F6516FB3B1A646D4EA108F1AD55427DA3719B4AFCCF588431CF0D8F3A5DE2CE8819384

Function 00007FF66B159AD0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF66B159B70
memcpy.MSVCRT ref: 00007FF66B159BA4

Strings

basic_string::_M_create, xrefs: 00007FF66B159C8A

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy
String ID: basic_string::_M_create
API String ID: 3510742995-3122258987
Opcode ID: 7e10e32ac9c35db058e90487a6080d84e7f032eec5cf6f161ccd5e809dc8062e
Instruction ID: 439d84a30d5e83ba59dceb5cb7b5c35548b26ec460d38339d34a22520c4ac7f0
Opcode Fuzzy Hash: 7e10e32ac9c35db058e90487a6080d84e7f032eec5cf6f161ccd5e809dc8062e
Instruction Fuzzy Hash: 384105F3B09686F1EA218A11912037AA7A1AB49BDCF544531CE5D8F7E6EF2CE441C346

Function 00007FF8A8E01010 Relevance: 6.1, APIs: 4, Instructions: 107sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FF8A8E01055
_amsg_exit.MSVCRT ref: 00007FF8A8E01083

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: ea90c6ae04c204992f07de965c2acf4cec1f64947ab0b8c5c40436d5bda2447b
Instruction ID: 2507ec57ad9b7ee55a945db065f3f0dbca5622dd7d51a83d711e5300eb1bd459
Opcode Fuzzy Hash: ea90c6ae04c204992f07de965c2acf4cec1f64947ab0b8c5c40436d5bda2447b
Instruction Fuzzy Hash: 15418631A4E243E5F7659B26E84063922A1FF49BC0F644836DE8D4B395EF7CE8518378

Function 00007FF8A8E091EB Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A8E09256

Strings

new , xrefs: 00007FF8A8E11392
, xrefs: 00007FF8A8E113FB
: , xrefs: 00007FF8A8E09299

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: strcmp
String ID: $ : $new
API String ID: 1004003707-2075650739
Opcode ID: 0430882e73798ec669b8537a12b1e922c44257219182452aef923a062707c5b7
Instruction ID: 7562c314485eb5ab3b4a886e3e4e6303d52c9f79c698c1463135ee8bdee3c9ab
Opcode Fuzzy Hash: 0430882e73798ec669b8537a12b1e922c44257219182452aef923a062707c5b7
Instruction Fuzzy Hash: 21418D72B4A746A1EB559B26A8003E92661EB51FD4F444032CF0D0B7C6EF7DD8919364

Function 00007FF66B12C45B Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF66B12C4C6

Strings

: , xrefs: 00007FF66B12C509
, xrefs: 00007FF66B13466B
new , xrefs: 00007FF66B134602

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: strcmp
String ID: $ : $new
API String ID: 1004003707-2075650739
Opcode ID: e2f0a109c7a48eab34b8866aac28482f605417ef8f9db755fd48e7852cccf2e1
Instruction ID: 27c717abb6f906bc7c8dba36dc75cbe5437f90646f04df700fc3f5327bf49ee1
Opcode Fuzzy Hash: e2f0a109c7a48eab34b8866aac28482f605417ef8f9db755fd48e7852cccf2e1
Instruction Fuzzy Hash: 69418D72A44746D1E7159A16E8003F96761EB8AFD8F844032CF0D8F7A6EE7CD9C58350

Function 00007FF66B153A10 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 87stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF66B153A38
memcpy.MSVCRT ref: 00007FF66B153A67

Strings

basic_string::_S_construct null not valid, xrefs: 00007FF66B153AD5
basic_string::_S_create, xrefs: 00007FF66B153A12, 00007FF66B153AF0

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_S_construct null not valid$basic_string::_S_create
API String ID: 3412268980-1585226940
Opcode ID: f48bfb832dd380944cb06afe18995df38a850548cb6180fe75f04cebcc32e1fc
Instruction ID: 2b18e7389259b098e100a2f5232ef39cabc1ea510c728fe6c8b0b3af0c6770c7
Opcode Fuzzy Hash: f48bfb832dd380944cb06afe18995df38a850548cb6180fe75f04cebcc32e1fc
Instruction Fuzzy Hash: CB2191B2A09A46E4EA21AB1AE9551B9A7B8BF5DBCCF444431C94D8F371DE2CD452C340

Function 00007FF66B1470A0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66B15CDA0: malloc.MSVCRT ref: 00007FF66B15CDB7

memcpy.MSVCRT ref: 00007FF66B147134

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF66B14719B
basic_string::substr, xrefs: 00007FF66B147194
basic_string::_S_create, xrefs: 00007FF66B1471A7

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: mallocmemcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_S_create$basic_string::substr
API String ID: 4276657696-2722529413
Opcode ID: c02f7cc657752da201b8f1fc3b6d016a06fa11269a8dde5a7c0adece318363aa
Instruction ID: 95cbfdb79ebceda8349826bcca7db1b8bed46086e99c59b1e183ae56934c68ff
Opcode Fuzzy Hash: c02f7cc657752da201b8f1fc3b6d016a06fa11269a8dde5a7c0adece318363aa
Instruction Fuzzy Hash: 2721A263B05641E5EF109F12D8402F8A7B4AB59BACF484632DA6C8B3E1EE7CD584C380

Function 00007FF66B155E20 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF66B155E4B
memset.MSVCRT ref: 00007FF66B155E8B

Strings

basic_string::at: __n (which is %zu) >= this->size() (which is %zu), xrefs: 00007FF66B155EC8
basic_string::_M_create, xrefs: 00007FF66B155E9D

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memset
String ID: basic_string::_M_create$basic_string::at: __n (which is %zu) >= this->size() (which is %zu)
API String ID: 2221118986-670834496
Opcode ID: 513e07350c62d84332d4d6c689426704dbe99d4dec5c211aae0685b48c88d3ea
Instruction ID: 0100fa8bd646f3f883a2301a283e7d6ae0d99f0ebb524ce3d272dafbbaa2dd37
Opcode Fuzzy Hash: 513e07350c62d84332d4d6c689426704dbe99d4dec5c211aae0685b48c88d3ea
Instruction Fuzzy Hash: CC1182B3A19642E1EA149B29E9411BDD771BB5DBC8F988031C64D8F771EE3CE5828344

Function 00007FF8A8E01480 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 00007FF8A8E1F6EC
_unlock.MSVCRT ref: 00007FF8A8E1F716
calloc.MSVCRT ref: 00007FF8A8E1F76A

Memory Dump Source

Source File: 00000000.00000002.2027640799.00007FF8A8E01000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF8A8E00000, based on PE: true

Associated: 00000000.00000002.2027607080.00007FF8A8E00000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027706128.00007FF8A8E23000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027823027.00007FF8A8F2B000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027875456.00007FF8A8F2C000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027915634.00007FF8A8F32000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2027982924.00007FF8A8F33000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2028035847.00007FF8A8F36000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8a8e00000_RUN.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: 6fed6af35d6377eeaf33dea0b13f6067e7eeb48fc11742e07c14ec66970ee409
Instruction ID: 6be0fba81d788360f1f937940ee3c40a989694fb0cd4d86769c35b225e775c5f
Opcode Fuzzy Hash: 6fed6af35d6377eeaf33dea0b13f6067e7eeb48fc11742e07c14ec66970ee409
Instruction Fuzzy Hash: 3811A17171BA41E1EE859B21D4102B82294EF59BD4F588534DE4D0B7C8EF7CE4608364

Function 00007FF66B148660 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF66B1486E2

Strings

basic_string::substr, xrefs: 00007FF66B1486FB
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF66B148702
basic_string::_M_create, xrefs: 00007FF66B1486EC

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_create$basic_string::substr
API String ID: 3510742995-456333499
Opcode ID: fe0e1dfac79b53972a9ba73ebc3b02ade7921f9d3e602a10edb5b6d54a03e240
Instruction ID: 59bf101a7420aa0318cd13f1ea38fead972e183b7374a96f838ee30dfd438276
Opcode Fuzzy Hash: fe0e1dfac79b53972a9ba73ebc3b02ade7921f9d3e602a10edb5b6d54a03e240
Instruction Fuzzy Hash: 03119472B09646E2EE609F25E9501B9E374AB1DB8CF584431CA4D8F3A1DF2CE591C380

Function 00007FF66B154370 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

random_device could not be read, xrefs: 00007FF66B15474A

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID:
String ID: random_device could not be read
API String ID: 0-883157155
Opcode ID: b7adfb6ff067615701c187db3c339df28920f5c274586aa2b6295ef7953e7104
Instruction ID: d8b68d8f8ae7f49b07a4cd13726049f55f392f3c760ffe3b5e18eec6c9f2dced
Opcode Fuzzy Hash: b7adfb6ff067615701c187db3c339df28920f5c274586aa2b6295ef7953e7104
Instruction Fuzzy Hash: 8B01A577B1A512E5FA115B29E501178A3B46B4D7A8F484530DE1C8B3B4DE38E892C708

Function 00007FF66B13A860 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF66B13A8E0

Strings

Unknown error, xrefs: 00007FF66B13A94C
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF66B13A8C7

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 7cba518cbd68afaaa035795e651e1b2a5dfcc68d27e1558acfada10b5381ce34
Instruction ID: a4253b93d5b1deb56d3a73f3ab5aedab44e652c91ca8540204bff57b941a835e
Opcode Fuzzy Hash: 7cba518cbd68afaaa035795e651e1b2a5dfcc68d27e1558acfada10b5381ce34
Instruction Fuzzy Hash: D501A562908E84D6D6168F1CD4011FAB374FF5D75EF245325EA8C6A230EF29D543C700

Function 00007FF66B13A940 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF66B13A8E0

Strings

Total loss of significance (TLOSS), xrefs: 00007FF66B13A940
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF66B13A8C7

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 06d7f25b42b335a6d39626709fba0da1e6bd412956792726a883ca79f5a9dd90
Instruction ID: a72f93c6ae4931246485761b9b2c5980c2ddaac00a72165348607bfa96c254e2
Opcode Fuzzy Hash: 06d7f25b42b335a6d39626709fba0da1e6bd412956792726a883ca79f5a9dd90
Instruction Fuzzy Hash: A5F04F12918E84C2D2129F18A4001BBB374FF5E78DF285326EA8D6A535DF28D9838700

Function 00007FF66B13A920 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF66B13A8E0

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF66B13A920
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF66B13A8C7

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: f2a51b33a73adb0c17cee875df969e7a1fd5de8da9e96991e8b5ef9222c603b3
Instruction ID: cb5e83da1d7425e21d99d7a2ec6b2004838c34dc597a730e9db4900d14f67e21
Opcode Fuzzy Hash: f2a51b33a73adb0c17cee875df969e7a1fd5de8da9e96991e8b5ef9222c603b3
Instruction Fuzzy Hash: 69F04F12918E84C2D2129F18A4001BBB374FF5E78DF285326EA8D6A175DF28D5838700

Function 00007FF66B13A930 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF66B13A8E0

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF66B13A930
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF66B13A8C7

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 819b97ec33a940c195b786b9d3aa486cf7cb18825143c4cd1f47cb55bac76b61
Instruction ID: 1b1a077a65adf935480e47901f4967d066edc4cac4fd9a244eb368c0b80af061
Opcode Fuzzy Hash: 819b97ec33a940c195b786b9d3aa486cf7cb18825143c4cd1f47cb55bac76b61
Instruction Fuzzy Hash: 0CF04F12918E84C2D6129F19A4001BBB374FF5E78DF285326EA8D6E175DF28D5838700

Function 00007FF66B13A900 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF66B13A8E0

Strings

Argument domain error (DOMAIN), xrefs: 00007FF66B13A900
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF66B13A8C7

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 210ac2638238c34202608c45c59e2a9818879b13fedbd679fc2f2c4b1c69e67e
Instruction ID: 468f76fd336ef9b5b344f7496c4c96f7ee5b64f1fba33396f2c3d74a610e7e62
Opcode Fuzzy Hash: 210ac2638238c34202608c45c59e2a9818879b13fedbd679fc2f2c4b1c69e67e
Instruction Fuzzy Hash: 59F04F12918E84C2D2129F18A4001BBB374FF5E78DF285326EA8D6A175DF28D5838700

Function 00007FF66B13A910 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF66B13A8E0

Strings

Partial loss of significance (PLOSS), xrefs: 00007FF66B13A910
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF66B13A8C7

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 720e28e65639f37131c431d2c4d43377f9814baac96bcc64b6cad2ad33369ccf
Instruction ID: 7b0947523cbfc024131cc22105f3b9a2730c60c165386d5937fa3f828652af5a
Opcode Fuzzy Hash: 720e28e65639f37131c431d2c4d43377f9814baac96bcc64b6cad2ad33369ccf
Instruction Fuzzy Hash: 47F04F12918E84C2D2129F19A4001BBB374FF5E78DF285326EA8D6A175DF28D5838700

Function 00007FF66B13A898 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF66B13A8E0

Strings

Argument singularity (SIGN), xrefs: 00007FF66B13A898
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF66B13A8C7

Memory Dump Source

Source File: 00000000.00000002.2027310223.00007FF66B121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66B120000, based on PE: true

Associated: 00000000.00000002.2027285620.00007FF66B120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027359204.00007FF66B15E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027391261.00007FF66B15F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027509339.00007FF66B29D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027547427.00007FF66B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66b120000_RUN.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 8ef68f5c87c57c10b600611a8e189b37a3e6596aec13e4f0b3ceab8f41f38459
Instruction ID: 5345543bbcd1d7c0b475be192ecf9e5bd6626158395864548eb2e7c9a77947ae
Opcode Fuzzy Hash: 8ef68f5c87c57c10b600611a8e189b37a3e6596aec13e4f0b3ceab8f41f38459
Instruction Fuzzy Hash: DEF01D22918E84C2D2129F29E4001ABB374FF5EB9DF285326EE8D6E535DF28D5838700

Analysis Process: RUN.exePID: 5320, Parent PID: 4592COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.8%
Total number of Nodes:	1776
Total number of Limit Nodes:	101

Executed Functions

Function 00000001400B947C Relevance: 33.3, APIs: 22, Instructions: 278
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00000001400B9529
GetLastError.KERNEL32 ref: 00000001400B9533
FindFirstFileW.KERNEL32 ref: 00000001400B954A
GetLastError.KERNEL32 ref: 00000001400B9556
FindClose.KERNEL32 ref: 00000001400B9564
__std_fs_open_handle.LIBCPMT ref: 00000001400B95F7
CloseHandle.KERNEL32 ref: 00000001400B960D
CloseHandle.KERNEL32 ref: 00000001400B9780
GetLastError.KERNEL32 ref: 00000001400B97D0
GetFileAttributesW.KERNEL32 ref: 00000001400B97DF
__std_fs_open_handle.LIBCPMT ref: 00000001400B9808

Part of subcall function 00000001400B9850: CreateFileW.KERNEL32 ref: 00000001400B9883
Part of subcall function 00000001400B9850: GetLastError.KERNEL32 ref: 00000001400B9892

CloseHandle.KERNEL32 ref: 00000001400B981A

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: CloseErrorFileLast$Handle$AttributesFind__std_fs_open_handle$CreateFirst
String ID:
API String ID: 3856372171-0
Opcode ID: 3115d4354ebb1865d7afd77323c82eee4fd58081d18b420f9cf0354a3ec1495e
Instruction ID: 8eb9bdafdb7ad43ecbbc04621b2b47f91323acc18f6e43efebf973be32b3e81b
Opcode Fuzzy Hash: 3115d4354ebb1865d7afd77323c82eee4fd58081d18b420f9cf0354a3ec1495e
Instruction Fuzzy Hash: 34B17F32214E4186E7668FA7A8447EA63A0EB8D7F0F144714BBBA476F6DF38C8458700

Function 000000014003B4B0 Relevance: 29.2, APIs: 12, Strings: 4, Instructions: 1190libraryloaderprocessCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 000000014003B59C
GetProcAddress.KERNEL32 ref: 000000014003B6A7
GetProcAddress.KERNEL32 ref: 000000014003B769
GetProcAddress.KERNEL32 ref: 000000014003B7E3
GetProcAddress.KERNEL32 ref: 000000014003B865
GetProcAddress.KERNEL32 ref: 000000014003B8DF
GetProcAddress.KERNEL32 ref: 000000014003B963
FreeLibrary.KERNEL32 ref: 000000014003C491
CreateToolhelp32Snapshot.KERNEL32 ref: 000000014003C59A
Process32FirstW.KERNEL32 ref: 000000014003C5DC
Process32NextW.KERNEL32 ref: 000000014003C7D3
CloseHandle.KERNEL32 ref: 000000014003CA4A

Strings

vault, xrefs: 000000014003C2F3
system, xrefs: 000000014003C29D
cannot use push_back() with , xrefs: 000000014003C4DF
[PID: , xrefs: 000000014003C61E

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: AddressProc$LibraryProcess32$CloseCreateFirstFreeHandleLoadNextSnapshotToolhelp32
String ID: [PID: $cannot use push_back() with $system$vault
API String ID: 2918959303-1782543976
Opcode ID: f319670b5f3719bf20a84c826ebdc6f613c371897955ff08d995636d490b1b84
Instruction ID: e7d04de0bf7d2ede0252bd06ce868167f405002912ec9c35e0160d414693bfc9
Opcode Fuzzy Hash: f319670b5f3719bf20a84c826ebdc6f613c371897955ff08d995636d490b1b84
Instruction Fuzzy Hash: 91D26C32215BC48ADB62CF26E8843DE77A4F789798F504215EB9C4BBA9DF74C694C700

Function 000000014005C7C0 Relevance: 26.5, APIs: 4, Strings: 10, Instructions: 1970COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000000014005C855

Strings

, xrefs: 000000014005C89F
ios_base::eofbit set, xrefs: 000000014005EBF8
ios_base::badbit set, xrefs: 000000014005EBE5
cmd /c "", xrefs: 000000014005E13F
status, xrefs: 000000014005EBBB
--key ", xrefs: 000000014005E1F7
APPB:, xrefs: 000000014005E51D
ios_base::failbit set, xrefs: 000000014005EBF1
" --type , xrefs: 000000014005E18D
File.exe, xrefs: 000000014005DC7C

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: FileModuleName
String ID: $ --key "$" --type $APPB:$File.exe$cmd /c ""$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$status
API String ID: 514040917-944069670
Opcode ID: d5a91056d79af5776f69b563551cc3ee9e14be56efeae97973d261ddaf968e40
Instruction ID: 61e81783eac7888240027048ff5e8352e61f2b385e44ecdac473786fa9e86fdc
Opcode Fuzzy Hash: d5a91056d79af5776f69b563551cc3ee9e14be56efeae97973d261ddaf968e40
Instruction Fuzzy Hash: E3235D72A14BC48AEB21CF29E8853DE73B1F789798F505215EB9C07BA9EB75C580C740

Function 000000014003787D Relevance: 24.3, APIs: 2, Strings: 10, Instructions: 3325COMMON

Download Yara Rule

APIs

Part of subcall function 000000014002CD90: __std_fs_code_page.LIBCPMT ref: 000000014002CDC7
Part of subcall function 000000014002CD90: __std_fs_convert_wide_to_narrow.LIBCPMT ref: 000000014002CE0E
Part of subcall function 000000014002CD90: __std_fs_convert_wide_to_narrow.LIBCPMT ref: 000000014002CE4A

CredEnumerateA.ADVAPI32 ref: 000000014003A9B2
CredFree.ADVAPI32 ref: 000000014003B3D6

Strings

cannot use push_back() with , xrefs: 000000014003B424
status, xrefs: 0000000140038D17
content, xrefs: 0000000140037B4F, 0000000140037ED7, 00000001400387F4, 0000000140039A42, 000000014003A5DF
users, xrefs: 0000000140038212
key, xrefs: 00000001400392DD, 00000001400394AD
exists, xrefs: 0000000140039E16, 000000014003A8F7
filename, xrefs: 0000000140037AF6, 0000000140037E7E, 0000000140038712, 00000001400398C9, 000000014003A439
directory_iterator::directory_iterator, xrefs: 0000000140039E6A, 000000014003A913
config, xrefs: 0000000140037C8D
files, xrefs: 0000000140039BB8

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Cred__std_fs_convert_wide_to_narrow$EnumerateFree__std_fs_code_page
String ID: cannot use push_back() with $config$content$directory_iterator::directory_iterator$exists$filename$files$key$status$users
API String ID: 1529200026-1424636042
Opcode ID: 73403cb4b12a15e7d187e246962c84645803850f68a0bf444581b730bc92aebc
Instruction ID: b5bf4b2957272ce0c7a3555bb348d851467700f7fbb7f4258258ad653565a7cc
Opcode Fuzzy Hash: 73403cb4b12a15e7d187e246962c84645803850f68a0bf444581b730bc92aebc
Instruction Fuzzy Hash: 39736C72611BC489EB229F36D8843DE73A1F789798F505216EB9D0BBA9DF74C684C340

Function 0000000140080A20 Relevance: 24.3, APIs: 16, Instructions: 266
fileprocesspipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNEL32 ref: 0000000140080AA7
SetHandleInformation.KERNEL32 ref: 0000000140080B05
GetStdHandle.KERNEL32 ref: 0000000140080B30
CreateProcessA.KERNEL32 ref: 0000000140080B85
CloseHandle.KERNEL32 ref: 0000000140080B94
CloseHandle.KERNEL32 ref: 0000000140080B9F
CloseHandle.KERNEL32 ref: 0000000140080BB4
CloseHandle.KERNEL32 ref: 0000000140080BBE
CloseHandle.KERNEL32 ref: 0000000140080BC8
ReadFile.KERNEL32 ref: 0000000140080C5D
ReadFile.KERNEL32 ref: 0000000140080CE6
CloseHandle.KERNEL32 ref: 0000000140080D02
GetCurrentProcess.KERNEL32 ref: 0000000140080DCB
OpenProcessToken.ADVAPI32 ref: 0000000140080DDE
GetTokenInformation.ADVAPI32 ref: 0000000140080E1A
CloseHandle.KERNEL32 ref: 0000000140080E3B

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Handle$Close$Process$CreateFileInformationReadToken$CurrentOpenPipe
String ID:
API String ID: 435572905-0
Opcode ID: dceccd4bed3033d5f2363029517fae0d28a7953c8672b6cc8744d3babce8565b
Instruction ID: 08d826af7e99bc8bdefcb617d8d7770f7d9f6d118e205ee12a4e83850e2cc550
Opcode Fuzzy Hash: dceccd4bed3033d5f2363029517fae0d28a7953c8672b6cc8744d3babce8565b
Instruction Fuzzy Hash: CBC17532614B808AE751CF66E84479E77A4FB88BD8F104229FB8D47BA8DF79C585C740

Function 000000014005A150 Relevance: 17.6, APIs: 1, Strings: 8, Instructions: 1871COMMON

Download Yara Rule

APIs

Part of subcall function 000000014002CD90: __std_fs_code_page.LIBCPMT ref: 000000014002CDC7
Part of subcall function 000000014002CD90: __std_fs_convert_wide_to_narrow.LIBCPMT ref: 000000014002CE0E
Part of subcall function 000000014002CD90: __std_fs_convert_wide_to_narrow.LIBCPMT ref: 000000014002CE4A

Concurrency::cancel_current_task.LIBCPMT ref: 000000014005C62E

Part of subcall function 000000014003F990: Concurrency::cancel_current_task.LIBCPMT ref: 000000014003FA98

Part of subcall function 00000001400499F0: Concurrency::cancel_current_task.LIBCPMT ref: 0000000140049B54

Strings

cannot use push_back() with , xrefs: 000000014005C646, 000000014005C71A
recursive_directory_iterator::recursive_directory_iterator, xrefs: 000000014005C6B6, 000000014005C784
recursive_directory_iterator::operator++, xrefs: 000000014005C69F, 000000014005C76D
status, xrefs: 000000014005C5D0, 000000014005C615, 000000014005C6F5
content, xrefs: 000000014005AC64, 000000014005B629, 000000014005C0E9
exists, xrefs: 000000014005C5A9, 000000014005C5F9, 000000014005C6D3, 000000014005C7A1
filename, xrefs: 000000014005AB64, 000000014005B554, 000000014005C014
directory_iterator::directory_iterator, xrefs: 000000014005C5C0

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Concurrency::cancel_current_task$__std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: cannot use push_back() with $content$directory_iterator::directory_iterator$exists$filename$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 1976907724-4250644884
Opcode ID: f76acbabd9b7fc25343503b6a8c330868902475f44ffdb2e9b13e08de79a8c06
Instruction ID: 8809c4aa34f17827eceedf5296657790c0cf14a5d9a0c4c9fcbc809bdbde575e
Opcode Fuzzy Hash: f76acbabd9b7fc25343503b6a8c330868902475f44ffdb2e9b13e08de79a8c06
Instruction Fuzzy Hash: 00235B72219BC481DA72DB16E4903EEB3A5F7C9790F505216E7DD43AA9EF78C684CB00

Function 0000000140080220 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 0000000140080461
SetFilePointer.KERNEL32 ref: 0000000140080514
ReadFile.KERNEL32 ref: 0000000140080543

Strings

ios_base::eofbit set, xrefs: 0000000140080984
ios_base::badbit set, xrefs: 0000000140080971, 00000001400809EF
ios_base::failbit set, xrefs: 000000014008097D
exists, xrefs: 00000001400809CA

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: e5d800745fb8e7e2dd03b421b13ff1905d1c5e73d58b6af64d1d7922d8c8c38c
Instruction ID: 1db62b8b794dd3ca4bccbc185c38139f2fcf59a025558d5ec4928ed644292a46
Opcode Fuzzy Hash: e5d800745fb8e7e2dd03b421b13ff1905d1c5e73d58b6af64d1d7922d8c8c38c
Instruction Fuzzy Hash: 87321632614BC489EB61CF36D8803DD37A1F789788F508226EB8D5BBA9EB74C645C700

Function 00000001400A44E8 Relevance: 10.8, APIs: 7, Instructions: 286
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400A491A

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1e049b80a000f3e8df67c0bf099f5713ff563aac723c2cbcb527b6014d8204dd
Instruction ID: 311eb4890aa1e646f6fda1dca96031ce27afa58cd9f7d28d97c51fe51a359056
Opcode Fuzzy Hash: 1e049b80a000f3e8df67c0bf099f5713ff563aac723c2cbcb527b6014d8204dd
Instruction Fuzzy Hash: 27C1C37A20468596E7629B2794403EE77A0F7E9BD4F554301FB4A07BF6CB78C4A5CB00

Function 0000000140034D60 Relevance: 9.5, APIs: 2, Strings: 3, Instructions: 797
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32 ref: 0000000140034E3F
FindNextFileW.KERNEL32 ref: 0000000140035626

Strings

content, xrefs: 000000014003550F
filename, xrefs: 000000014003541A
exists, xrefs: 0000000140035A3A

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: FileFind$FirstNext
String ID: content$exists$filename
API String ID: 1690352074-1949714836
Opcode ID: fd423bae6550b93b27f2fd5a8b7918c102f4e44d23883bb563c61e2567874888
Instruction ID: db733362f45c485840bcbbef7125c6d102ee5b7c7d0765ab6974e4f61369fe59
Opcode Fuzzy Hash: fd423bae6550b93b27f2fd5a8b7918c102f4e44d23883bb563c61e2567874888
Instruction Fuzzy Hash: 62828F72618BC091EA22EB26E4943DEB3A1F7897D4F505216FB9D07AB9DF78C580C740

Function 000000014008FED0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 0000000140090084
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140090092
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140090315
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140090323

Strings

value, xrefs: 000000014008FFAA, 0000000140090243

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 5812492ce86ed497bda655677196accbe50fb2d66106d9da4e0882e704bf4fea
Instruction ID: e1201fbe2842836c1711549b92fe49df699a8957a4ef57640b057148a47efd92
Opcode Fuzzy Hash: 5812492ce86ed497bda655677196accbe50fb2d66106d9da4e0882e704bf4fea
Instruction Fuzzy Hash: DD029E72A25BC089EB02DB76D4903ED6761E7897E4F505212FBAD03AEADF78C585C700

Function 0000000140031D30 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 369
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000001400320B2

Strings

status, xrefs: 0000000140032A89
exists, xrefs: 0000000140031CD2, 0000000140032A4E
directory_iterator::directory_iterator, xrefs: 0000000140031CF4, 0000000140032A6D

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Open
String ID: directory_iterator::directory_iterator$exists$status
API String ID: 71445658-3429586796
Opcode ID: 6d3536808b6601f019be50ce807ded329804934b4cecdba008ecf2e1a869cbfa
Instruction ID: d283b85e10e05eaa99e0bfa5fb90223c84540dd864d34c541b6d693e1038403f
Opcode Fuzzy Hash: 6d3536808b6601f019be50ce807ded329804934b4cecdba008ecf2e1a869cbfa
Instruction Fuzzy Hash: ED12F372515BC48AE7628F3ADC813D933A4F74D798F115215EB9C1BBA9EF348694C300

Function 0000000140081FA0 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 460
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400B3110: AcquireSRWLockExclusive.KERNEL32 ref: 00000001400B3120

send.WS2_32 ref: 00000001400828F8

Strings

ios_base::badbit set, xrefs: 0000000140082810, 0000000140082847, 0000000140082885
exists, xrefs: 00000001400827EE

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: AcquireExclusiveLocksend
String ID: exists$ios_base::badbit set
API String ID: 3546000550-2074760687
Opcode ID: 603267f1e5945f7066521976707987ef831b7dbb5ea2156e3e1bb041e3b7de32
Instruction ID: b75098c5373e60eabab32f1287f4528ca12a78606437dfc6c979fea06e0d9e6a
Opcode Fuzzy Hash: 603267f1e5945f7066521976707987ef831b7dbb5ea2156e3e1bb041e3b7de32
Instruction Fuzzy Hash: 00328F72219BC495EB62DB16E4943DAB361F7C97D0F504226EB8D47AB9EF38C644CB00

Function 0000000140070410 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0000000140070468
LocalFree.KERNEL32 ref: 00000001400704FA

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 82b9eccce52bd76d2a38ae24875dcc72e8672f057a2d87ab5402ef8ecec02c81
Instruction ID: afc872794842f5d7a80fe0b33be2d975e624f313f4f4beaab358a86cdb16878d
Opcode Fuzzy Hash: 82b9eccce52bd76d2a38ae24875dcc72e8672f057a2d87ab5402ef8ecec02c81
Instruction Fuzzy Hash: 97414132618B80CAE3218F75E4403ED37A4F75878CF054229FB8817E9ADB79C6A4C754

Function 0000000140088D70 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 0000000140088DE1

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: d4b67670b12d6b03bf4d03815cb1ab65ac5729a21ba3a626c25476bbd116bb90
Instruction ID: 557e1561279e9319c45ff12f5330aa19f18cc0f904c9a554cfe8fd03b15ab88b
Opcode Fuzzy Hash: d4b67670b12d6b03bf4d03815cb1ab65ac5729a21ba3a626c25476bbd116bb90
Instruction Fuzzy Hash: 79414A32A18B8086E711CF25E88039EB765F798788F545215EF8823A7ADB78D6D1DB40

Function 00000001400BF088 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400BEC68: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BECA9
Part of subcall function 00000001400BEC68: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BED29
Part of subcall function 00000001400BEC68: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BED7D
Part of subcall function 00000001400BEC68: _get_daylight.LIBCMT ref: 00000001400BEDD5

CreateFileW.KERNEL32 ref: 00000001400BF18E
CreateFileW.KERNEL32 ref: 00000001400BF1DE
GetLastError.KERNEL32 ref: 00000001400BF20E
GetFileType.KERNEL32 ref: 00000001400BF223
GetLastError.KERNEL32 ref: 00000001400BF22D
CloseHandle.KERNEL32 ref: 00000001400BF260
CloseHandle.KERNEL32 ref: 00000001400BF3C4
CreateFileW.KERNEL32 ref: 00000001400BF3F9
GetLastError.KERNEL32 ref: 00000001400BF408

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 89f66b6610d6b76355aad9393293e6923e70a4ceebab5d019a286a560852aeaf
Instruction ID: 7e1bac18a1fa27ba0e3626425be6fd919a990661db27a343ff72421f1822e8fe
Opcode Fuzzy Hash: 89f66b6610d6b76355aad9393293e6923e70a4ceebab5d019a286a560852aeaf
Instruction Fuzzy Hash: 4EC1AA36720A4086EB11CFAAD4907ED37B1E38DBE8F015215EB6A9B7E4CB38C556C300

Function 0000000140092200 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400923DB
Concurrency::cancel_current_task.LIBCPMT ref: 00000001400925E4
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140092760

Strings

3G, xrefs: 00000001400925F0

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: 3G
API String ID: 118556049-4175570335
Opcode ID: dc13ff376bcf86e98a9bd46123576a4ecea656a87780a0d93674023c741dea10
Instruction ID: 027559f12c40b68a589cec7442c04c586ebfd30c2bed3669483d128cae4efade
Opcode Fuzzy Hash: dc13ff376bcf86e98a9bd46123576a4ecea656a87780a0d93674023c741dea10
Instruction Fuzzy Hash: 60E1CF32311B8482EA26DF66E5507AE63A4F748BE4F158625BFAD07BE5DF38C590C300

Function 000000014008BC70 Relevance: 6.1, APIs: 4, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000000014008BC90
FreeEnvironmentStringsW.KERNEL32 ref: 000000014008BD8B
RtlInitUnicodeString.NTDLL ref: 000000014008BDFE
RtlInitUnicodeString.NTDLL ref: 000000014008BE0B

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: 2024ece25ad8d0dfea4effba769dec7aa09a5c5de80b191ca38a469a83a442ee
Instruction ID: b7dc9a918e5ba752c6d1a4cb5c38ae9a660f8eccf0d9eb2d11592ecb9e15c57e
Opcode Fuzzy Hash: 2024ece25ad8d0dfea4effba769dec7aa09a5c5de80b191ca38a469a83a442ee
Instruction Fuzzy Hash: 40519C73A14B8082EB129F2AE44039D7760FB99BD4F549201EB9903BA9DF78D2E1C300

Function 0000000140088A60 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140088AE9
RegEnumKeyExA.ADVAPI32 ref: 0000000140088B2E

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: 874aa622c5a3d824425461c65662d2d43391222831d7590eb0f667cf23b31fbc
Instruction ID: 1f3d119ddd6be03377ae911e8af97b363e8761d5105245f1140f8753357e1b7f
Opcode Fuzzy Hash: 874aa622c5a3d824425461c65662d2d43391222831d7590eb0f667cf23b31fbc
Instruction Fuzzy Hash: 8B316F32600B8486E721CFA2E854B9E77B4FB587D8F200215EF9917BA9DF78C596C700

Function 000000014003EF30 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014003F11C

Strings

, xrefs: 000000014003EFB3

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: d55a3be85ee1055ffb164e61d513251a61e523bc0d60f301511b3fa1e8536299
Instruction ID: f6480eac9df0a921f3b00285bac3b51a84fd8ea17e78b66d21925ff5f031d515
Opcode Fuzzy Hash: d55a3be85ee1055ffb164e61d513251a61e523bc0d60f301511b3fa1e8536299
Instruction Fuzzy Hash: 47514772304B8496EB1A8F2AD5943AD33A0F748BD4F948626EF5D43BA5CF79D4A1D300

Function 0000000140045510 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014004566B

Strings

cannot use operator[] with a numeric argument with , xrefs: 0000000140045A39

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: cannot use operator[] with a numeric argument with
API String ID: 118556049-485864652
Opcode ID: 2dc08532d42dd49a5db915f0d5e93add294414e31bce98d7278f60cda99f26a2
Instruction ID: 371ac32ebd64c0a65e8e7c90172ce9660e8c02a6c767e6c44b0ce195739b907e
Opcode Fuzzy Hash: 2dc08532d42dd49a5db915f0d5e93add294414e31bce98d7278f60cda99f26a2
Instruction Fuzzy Hash: 04312472305B8095EE12AF27A5443EC6366A70CBD5F594635BF6D0B7E6DE38C081C308

Function 00000001400800D0 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 0000000140080129
CoTaskMemFree.OLE32 ref: 00000001400801EA

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 4c56703e9db33eba310997f99d84547c884f29c524f839be628be20939f7ed24
Instruction ID: 5add4f13673e70b7bdbdfcd835062785cbc84354746477c7e55e7b925aee7934
Opcode Fuzzy Hash: 4c56703e9db33eba310997f99d84547c884f29c524f839be628be20939f7ed24
Instruction Fuzzy Hash: B9315372A14B8481E7218F6AE44535EB761F79D7F4F205315FBAC076A9DB7CC1818B40

Function 0000000140095764 Relevance: 3.1, APIs: 2, Instructions: 72COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014009578B

Part of subcall function 0000000140095720: _invalid_parameter_noinfo.LIBCMT ref: 0000000140095737

_invalid_parameter_noinfo.LIBCMT ref: 0000000140095838

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a78507b222b037ada6aaee86a71bd75569a92845782e1ac6615e1f2c814324ca
Instruction ID: bbaf9462e4f046ec167b3a9a7a0f9b6edd47eb1ea2c96129a4b6d0734281efab
Opcode Fuzzy Hash: a78507b222b037ada6aaee86a71bd75569a92845782e1ac6615e1f2c814324ca
Instruction Fuzzy Hash: 0F21AD32611A4481EA52EB57E8603EE7B61F799BD0F940126F71A473F2EE38C605C710

Function 00000001400A4A5C Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00000001400A4AA8
GetLastError.KERNEL32 ref: 00000001400A4AB2

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: eaf1f8ef5c1a5b971a02933aa1c6ac7e64f220fe336981d63eb8f17af6bd5ebf
Instruction ID: f8e6f1071c676b52ad1aa0f5b0496d911791eba876e8f28b275869f888e200a0
Opcode Fuzzy Hash: eaf1f8ef5c1a5b971a02933aa1c6ac7e64f220fe336981d63eb8f17af6bd5ebf
Instruction Fuzzy Hash: E7119E76304B8081DB518B2AB844399A361A7A8BF4F644311FF7A0BBE9DF78C5918B44

Function 00000001400B3188 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400B31B8

Part of subcall function 00000001400B40BC: std::bad_alloc::bad_alloc.LIBCMT ref: 00000001400B40C5

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400B31BE

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 2bbe7cb00d650c8495b1a37f35418748bfe0d1b071b89c59af51de45b9438ea8
Instruction ID: 685ad68cefcec46e584e821244bf574e3d27143f29d456f05cd7c7f67cb7bed9
Opcode Fuzzy Hash: 2bbe7cb00d650c8495b1a37f35418748bfe0d1b071b89c59af51de45b9438ea8
Instruction Fuzzy Hash: 88E0173061290941FD2B7AFB29163F501A81BAC7F0E2C1F247F760B2F3B934889A8211

Function 00000001400A2438 Relevance: 2.5, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00000001400A244E
GetLastError.KERNEL32 ref: 00000001400A2458

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 18741f14ee5fc7649e3f7a422f3a70dec762688bbcda5cce3cbbb9842fc06645
Instruction ID: c39f6ac59647204107da711e08ca7cb678c5d8f0a2a5e56943ae5d841e8e081c
Opcode Fuzzy Hash: 18741f14ee5fc7649e3f7a422f3a70dec762688bbcda5cce3cbbb9842fc06645
Instruction Fuzzy Hash: 88E08C70B0120083FB1A6BB3A8853E912905F9CBC1F844024BB51532B1DA3888864610

Function 00000001400945C0 Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140094810

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4ea5165e7de84b1b253d8127532d31a6650a8b8caeec333f5e5f1acc1f8b9973
Instruction ID: bc073ab4adc3091bf12103c657801eab9ed7c06d7e2875572eff87a04387dcaa
Opcode Fuzzy Hash: 4ea5165e7de84b1b253d8127532d31a6650a8b8caeec333f5e5f1acc1f8b9973
Instruction Fuzzy Hash: 4E61CC76305A8884EB16DF1BD1547AD63A1E30AFD8F148611EF6D0B7E5DB38C896C300

Function 000000014002DCC0 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 000000014002DDF3

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: 52c95a36d420af7ed9acb9f760d76bb5a4f15eb4bca73a49b86378a71e5a7803
Instruction ID: 23402884ce9da217c50eaeb71816ce61ababfff17732451bc600fe74fdc2cba9
Opcode Fuzzy Hash: 52c95a36d420af7ed9acb9f760d76bb5a4f15eb4bca73a49b86378a71e5a7803
Instruction Fuzzy Hash: 4161B072B10B4085FF12AB6AD4903EC33A1E7597E8F41461AFF195BAE9DB74CD918340

Function 0000000140045680 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140045815

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8f8ca1fe15d32ca870fd529cd5e95e1df55c2549d8fc7ade433c24bc009aa3ba
Instruction ID: ede7f60db1231b1048735d48ce7f8fc5d804a45ca4f500518fa05de5e20aac2a
Opcode Fuzzy Hash: 8f8ca1fe15d32ca870fd529cd5e95e1df55c2549d8fc7ade433c24bc009aa3ba
Instruction Fuzzy Hash: D041BB72319B8481EA12AF17E5443DDA3A5B70CBD5F584635EFAE0B7A6DE38C4428308

Function 0000000140069F40 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014006A0E7

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 12bdea5b5970b790af7726231cd17ac1295919ca1ed51c8ec952b2f6770b8b50
Instruction ID: 53a79a959c22fab3bc5a5401574e6ab8f61459da064b79c2914bf5a3a7b2c03d
Opcode Fuzzy Hash: 12bdea5b5970b790af7726231cd17ac1295919ca1ed51c8ec952b2f6770b8b50
Instruction Fuzzy Hash: 1A417072214B8481EA25DF66E5543AEB3A5F74DBD0F608A25FBAD03BA5DF3CC4508700

Function 00000001400A2934 Relevance: 1.6, APIs: 1, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400A295C

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 38e4acc591baea26d45ae4966e7f45e4d0796fac061fbd998d0e3074de549c94
Instruction ID: ff31ce48bc4bfb596dcc217db2409a5c95c38712441d1df2350013c1e2d47250
Opcode Fuzzy Hash: 38e4acc591baea26d45ae4966e7f45e4d0796fac061fbd998d0e3074de549c94
Instruction Fuzzy Hash: F9419A3221064487EA36CF1AE5403EA77A0F7A9BD4F140215FB86877B1CB38D982CB52

Function 0000000140044E89 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16cbce662e4213225d607acafa7ef867beae065a31398f2fed9e873b888393c
Instruction ID: 4f323dcee4391808b88f134d66f0dfc9770cd5a34c42c1311fc9159ece3a50e5
Opcode Fuzzy Hash: b16cbce662e4213225d607acafa7ef867beae065a31398f2fed9e873b888393c
Instruction Fuzzy Hash: 6A31E272305B8095EF26DF17E5003EDA362E74CBD8F594531BB5D0BBAADA38C5958308

Function 000000014003F990 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014003FA98

Part of subcall function 000000014002B320: __std_exception_copy.LIBVCRUNTIME ref: 000000014002B368

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy
String ID:
API String ID: 317858897-0
Opcode ID: f4b55cb47205c8e9704b4a1c1ada22670ca4bc633050713cc9845fdddc8a9b84
Instruction ID: 47077dbd96d4df3240ed2693c01ed96c8be32edbc81a6a70982af7bfefbd0e6c
Opcode Fuzzy Hash: f4b55cb47205c8e9704b4a1c1ada22670ca4bc633050713cc9845fdddc8a9b84
Instruction Fuzzy Hash: B821C372A01B4441EA1BAF56A1403FA2390A748BE4F244625AB7C07BE2EA78C5D29340

Function 00000001400A43CC Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400A44C3

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 34b7f82968351960678e391b9667d0d7d034be054c1c945fc0f6c6627217f2c9
Instruction ID: 66b28db9534addba0a85dd77e33a237dc12179b96d44befbaf29bd21c0a2d934
Opcode Fuzzy Hash: 34b7f82968351960678e391b9667d0d7d034be054c1c945fc0f6c6627217f2c9
Instruction Fuzzy Hash: D2318D3661160086F713AF6799813ED3A90A7EDBE5F964305FB1907BF2CB78C4818B11

Function 00000001400BE92C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BE94F

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e40550800b60e1bb72f775c1a83921a0ac67828d27f0c48bc289fab70a9f8f5a
Instruction ID: c334e94fdc1e1dc7971d03bd6093cbe29ca5be00248b0fa17f87788e0dc828fe
Opcode Fuzzy Hash: e40550800b60e1bb72f775c1a83921a0ac67828d27f0c48bc289fab70a9f8f5a
Instruction Fuzzy Hash: B321A832214A8087DBA2CF6AD4403A977B0F789BD4F544225F7994B6F9DB39C8058B00

Function 00000001400BC5E8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BC545

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9389d579a3a6dcf4e774c0897c4e4e35c49baa7c9073152e8fc6a039c31dfcd2
Instruction ID: fff2f8e84ef314ea999d243f31c69ff2bcf221428cf1d2c9fba5e89259d18593
Opcode Fuzzy Hash: 9389d579a3a6dcf4e774c0897c4e4e35c49baa7c9073152e8fc6a039c31dfcd2
Instruction Fuzzy Hash: C9118132324E8081EA729F9394107EEA3B4BB8DBC4F544421FB9957BB6DB78D9804B40

Function 00000001400355E3 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 0000000140035626

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 74ae114ab83ba0bdbd64def7fc9c5cd46c4c538ffc988a7ac250435435fdc9d1
Instruction ID: d32f629da9f9a1b966391ccf1de074b93170d508d09e4cf9410fbf28212e18ec
Opcode Fuzzy Hash: 74ae114ab83ba0bdbd64def7fc9c5cd46c4c538ffc988a7ac250435435fdc9d1
Instruction Fuzzy Hash: 8C01EC36218A8081DA61DB52F45439AA364F788BD4F504026EF8D53B69DE38D9868B00

Function 0000000140095E64 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140095E83

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 39da4e3257f63eb5f1de1f3a9c279ffd339e2eab57b4aa58fdc0b0940a098516
Instruction ID: 71d0ee86e6f2c17c8e5f2576092f5ce91377403d71e497d6511c23788c9a206e
Opcode Fuzzy Hash: 39da4e3257f63eb5f1de1f3a9c279ffd339e2eab57b4aa58fdc0b0940a098516
Instruction Fuzzy Hash: 51E0223260560042EB2A7BBB92803A876606F1C7F0F104720B734032E2DB31C8A04600

Function 00000001400B938C Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00000001400B9390

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 0664abf9f2bd90c5cf979f94efd67d533afdb6b1b4d70673d51c753431c4c20e
Instruction ID: 8bfeb1da91aebbbdcaab9047d5cf318d8cd871cb64d4e86293c1e7a3d8382537
Opcode Fuzzy Hash: 0664abf9f2bd90c5cf979f94efd67d533afdb6b1b4d70673d51c753431c4c20e
Instruction Fuzzy Hash: EFC09B34F11901C3E7551BB37C8239911E07B4C7D1F80C420F30582170D97C82E74721

Function 00000001400A2AA0 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00000001400A2AF5

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 4ba3e788e5f06de8d0d7a42dc83ad3e036eb6a66a1ad80d3e2e9592768c94d4b
Instruction ID: 752c29c6aea045825f53652dbd69cb5a14d3db7a4a20548f5c26e44ff5818212
Opcode Fuzzy Hash: 4ba3e788e5f06de8d0d7a42dc83ad3e036eb6a66a1ad80d3e2e9592768c94d4b
Instruction Fuzzy Hash: 5CF01D7431564142FE6B5A6B59513E612946BBCBC0F4C56306B4A877F2EE3CC8C58A21

Function 00000001400A4DD8 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00000001400A4E16

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b120254d9379692dd817d43f0c6e29d8dfdac875a721a9b9a6c6b8b58a0ff019
Instruction ID: 8ea3dd8dd1bface21b64ce9806e03740ec0eb6c93f9e42283125b95ce6f408d0
Opcode Fuzzy Hash: b120254d9379692dd817d43f0c6e29d8dfdac875a721a9b9a6c6b8b58a0ff019
Instruction Fuzzy Hash: 26F08C3470524041FF679AB36A003E912946BEC7E0F480B207F2687AE6DBB8C4C14910

Non-executed Functions

Function 0000000140070830 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 168networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00000001400709AB
InternetOpenUrlA.WININET ref: 00000001400709E0
InternetReadFile.WININET ref: 0000000140070A01
InternetReadFile.WININET ref: 0000000140070A3F
InternetCloseHandle.WININET ref: 0000000140070A4C
InternetCloseHandle.WININET ref: 0000000140070A55

Strings

File Downloader, xrefs: 00000001400709A4

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 52bd89ad8ebb9be53841be3c73c5e0ed2e683531a2068f7cd7ad79eb8aad156f
Instruction ID: c0e86da1592285b89577fac2bab92ff338ef488720a891908ff57b91ef877816
Opcode Fuzzy Hash: 52bd89ad8ebb9be53841be3c73c5e0ed2e683531a2068f7cd7ad79eb8aad156f
Instruction Fuzzy Hash: 0151D232305B8486FB129F67A8403E973A0EB4CBD4F544625FF9807BA6DF78C5928300

Function 00000001400AE120 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000000014009F0C0: GetLastError.KERNEL32 ref: 000000014009F0CF
Part of subcall function 000000014009F0C0: FlsGetValue.KERNEL32 ref: 000000014009F0E4
Part of subcall function 000000014009F0C0: SetLastError.KERNEL32 ref: 000000014009F16F

Part of subcall function 000000014009F0C0: FlsSetValue.KERNEL32 ref: 000000014009F105
Part of subcall function 000000014009F0C0: FlsGetValue.KERNEL32 ref: 000000014009F1A5

GetUserDefaultLCID.KERNEL32 ref: 00000001400AE290

Part of subcall function 000000014009F0C0: FlsSetValue.KERNEL32 ref: 000000014009F132
Part of subcall function 000000014009F0C0: FlsSetValue.KERNEL32 ref: 000000014009F143
Part of subcall function 000000014009F0C0: FlsSetValue.KERNEL32 ref: 000000014009F154
Part of subcall function 000000014009F0C0: FlsSetValue.KERNEL32 ref: 000000014009F1C4
Part of subcall function 000000014009F0C0: FlsSetValue.KERNEL32 ref: 000000014009F1EC

EnumSystemLocalesW.KERNEL32 ref: 00000001400AE277
ProcessCodePage.LIBCMT ref: 00000001400AE2BA
IsValidCodePage.KERNEL32 ref: 00000001400AE2CC
IsValidLocale.KERNEL32 ref: 00000001400AE2E2
GetLocaleInfoW.KERNEL32 ref: 00000001400AE33E
GetLocaleInfoW.KERNEL32 ref: 00000001400AE35A

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 8b353bbc207da57c2e890947fb281266b35f90efee0bed1458746f694561a586
Instruction ID: 677ceeff8a2bba887c9a0b7ac93e0c349c3f277213e01444a287f0232e46ac79
Opcode Fuzzy Hash: 8b353bbc207da57c2e890947fb281266b35f90efee0bed1458746f694561a586
Instruction Fuzzy Hash: CD7199327106908AFF129B62D8517ED33B4BB6CBC4F444626AF49537A5EB38C985CB60

Function 0000000140063140 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00000001400632F4
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140063302
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140063585
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140063593

Strings

value, xrefs: 000000014006321A, 00000001400634B3

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: bae27fa2daf5ce1be9dfc262d1c1d88d70d1ddb257fd21f42819694c13eac75d
Instruction ID: 374fd13976cd9cbbda9cc40f90f6c8f2c06360a5034c87a87c28f92700483217
Opcode Fuzzy Hash: bae27fa2daf5ce1be9dfc262d1c1d88d70d1ddb257fd21f42819694c13eac75d
Instruction Fuzzy Hash: AC028D72624BC085EB02DB76D8903ED6761E7897E4F605615FBAD03AEADF78C185C340

Function 00000001400BB8D4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400BB935
IsDebuggerPresent.KERNEL32 ref: 00000001400BB94D
OutputDebugStringW.KERNEL32 ref: 00000001400BB95E

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00000001400BB957

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 3a1574b4cf2c068a6f73bfaec146d08bcbd253e864d6d7ab073666d02a8d1c97
Instruction ID: 8c3ffa0e390ebcd7287117dcdab8348907fa21c2710699d16252293fc25dea72
Opcode Fuzzy Hash: 3a1574b4cf2c068a6f73bfaec146d08bcbd253e864d6d7ab073666d02a8d1c97
Instruction Fuzzy Hash: 73117C32210B40A7F7469B63E6553E933A4FB0C785F444125EB4A83A70EF78D5B8C750

Function 00000001400B40E8 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000001400B4114
GetCurrentThreadId.KERNEL32 ref: 00000001400B4122
GetCurrentProcessId.KERNEL32 ref: 00000001400B412E
QueryPerformanceCounter.KERNEL32 ref: 00000001400B413E

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c85254f88d441f93c9fadce3d916be205d43b39c9e8ef0887fe99bc8a8d9c2d7
Instruction ID: 4a5d1a9ce6991a4af6b95b257a39ca8fda0ee4838a81d21514d5a7b72354c1e5
Opcode Fuzzy Hash: c85254f88d441f93c9fadce3d916be205d43b39c9e8ef0887fe99bc8a8d9c2d7
Instruction Fuzzy Hash: A5112A36710F018AEB00CF61E8543A833A4F75D798F450E25EB6D877A4DFB8C1959390

Function 00000001400A3090 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00000001400A3104

Strings

GetLocaleInfoEx, xrefs: 00000001400A30AC, 00000001400A30BD

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 38d78014101564a752724bc621f730dcdbe557dc4a32a0c4965190c9e46fe1e2
Instruction ID: 0d9b71b41e46235a6b4c64160a8c6e87872d36b1a4377eb6e2c41c8ca465d5c3
Opcode Fuzzy Hash: 38d78014101564a752724bc621f730dcdbe557dc4a32a0c4965190c9e46fe1e2
Instruction Fuzzy Hash: F4016231704A8086EB469B67B4407DAA760EB9DBC0F584135FF4903BB5CE38C5428790

Function 00000001400D4118 Relevance: .0, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c80d82fee14e70756c96fffe48ca478f67024baad27bf2644eccdedac28b85cc
Instruction ID: 583a6451d315d86482f9d29e7cff008cbcca3771fa9541462f1d33d5b0b85f09
Opcode Fuzzy Hash: c80d82fee14e70756c96fffe48ca478f67024baad27bf2644eccdedac28b85cc
Instruction Fuzzy Hash: 0EF0829FD59ED212FA5341190C163D91B81AF277F4E180379AF386B2E25B1998035224

Function 00000001400D40D8 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3404fac62a40ecc1a023b7b6c28be12ef63c2e7462e9ca34998b29872df307
Instruction ID: 4a01d2d65d37945e2421efb18d16d34f3968ebe0554418cb56038d5111e66f16
Opcode Fuzzy Hash: 9e3404fac62a40ecc1a023b7b6c28be12ef63c2e7462e9ca34998b29872df307
Instruction Fuzzy Hash:

Function 000000014009F0C0 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000000014009F0CF
FlsGetValue.KERNEL32 ref: 000000014009F0E4
FlsSetValue.KERNEL32 ref: 000000014009F105
FlsSetValue.KERNEL32 ref: 000000014009F132
FlsSetValue.KERNEL32 ref: 000000014009F143
FlsSetValue.KERNEL32 ref: 000000014009F154
SetLastError.KERNEL32 ref: 000000014009F16F
FlsGetValue.KERNEL32 ref: 000000014009F1A5
FlsSetValue.KERNEL32 ref: 000000014009F1C4

Part of subcall function 00000001400A2AA0: HeapAlloc.KERNEL32 ref: 00000001400A2AF5

FlsSetValue.KERNEL32 ref: 000000014009F1EC

Part of subcall function 00000001400A2438: HeapFree.KERNEL32 ref: 00000001400A244E
Part of subcall function 00000001400A2438: GetLastError.KERNEL32 ref: 00000001400A2458

FlsSetValue.KERNEL32 ref: 000000014009F1FD
FlsSetValue.KERNEL32 ref: 000000014009F20E

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: fa7bb8e53e6df5224e78cdfaea57a7a090318e29cb18f213b4c860a7efa4244c
Instruction ID: 68b57aa3816c087398a4224c8fbabd7138c6a5b22c976d4b8f51e0bae11e5bbc
Opcode Fuzzy Hash: fa7bb8e53e6df5224e78cdfaea57a7a090318e29cb18f213b4c860a7efa4244c
Instruction Fuzzy Hash: 1641803030520486FAABA737A9513FE22925F5C7F4F540739BB360B6F6DE7898816790

Function 00000001400B98A8 Relevance: 16.8, APIs: 11, Instructions: 318COMMON

Download Yara Rule

APIs

__std_fs_open_handle.LIBCPMT ref: 00000001400B98E8

Part of subcall function 00000001400B9850: CreateFileW.KERNEL32 ref: 00000001400B9883
Part of subcall function 00000001400B9850: GetLastError.KERNEL32 ref: 00000001400B9892

SetFileInformationByHandle.KERNEL32 ref: 00000001400B9912
__std_fs_open_handle.LIBCPMT ref: 00000001400B994A
CloseHandle.KERNEL32 ref: 00000001400B9964
GetLastError.KERNEL32 ref: 00000001400B9998
GetFileInformationByHandleEx.KERNEL32 ref: 00000001400B99E4
GetLastError.KERNEL32 ref: 00000001400B99F2
CloseHandle.KERNEL32 ref: 00000001400B9A08
SetFileInformationByHandle.KERNEL32 ref: 00000001400B9A34
SetFileInformationByHandle.KERNEL32 ref: 00000001400B9A68
GetLastError.KERNEL32 ref: 00000001400B9A8A

Part of subcall function 000000014009EA90: IsProcessorFeaturePresent.KERNEL32 ref: 000000014009EAB6

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: Handle$File$ErrorInformationLast$Close__std_fs_open_handle$CreateFeaturePresentProcessor
String ID:
API String ID: 2221425841-0
Opcode ID: ad3e9298aeb44403546d6a016772fc9da57020dea84ee0de8089a149bed9bc16
Instruction ID: aa59bf950eddcf277865884bf0b95d65f9ac635cc4dd93d80d6bc0a77e7fc470
Opcode Fuzzy Hash: ad3e9298aeb44403546d6a016772fc9da57020dea84ee0de8089a149bed9bc16
Instruction Fuzzy Hash: 73C1E631700A8089FB624FBB94047ED6BB1BB5DBE4F184215EF5667BE6DB78C4418740

Function 00000001400BB19C Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00000001400BB20C
MultiByteToWideChar.KERNEL32 ref: 00000001400BB2AA
LCMapStringEx.KERNEL32 ref: 00000001400BB313
LCMapStringEx.KERNEL32 ref: 00000001400BB365
LCMapStringEx.KERNEL32 ref: 00000001400BB40A
WideCharToMultiByte.KERNEL32 ref: 00000001400BB464

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 1d2981027ae59fac705eeccbb109355d03c6fc085db9007b30242bacda297815
Instruction ID: 6075c61ae14a0a47515c67ee17ed355b2a884833940e5d1254ec4bc321ba5be6
Opcode Fuzzy Hash: 1d2981027ae59fac705eeccbb109355d03c6fc085db9007b30242bacda297815
Instruction Fuzzy Hash: 4681C172200B8087EB268FA2E85039D77E5FB58BE8F144621FB5947BE9DBB8C501C700

Function 00000001400BD9B8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BDC97

Part of subcall function 00000001400B0998: _invalid_parameter_noinfo.LIBCMT ref: 00000001400B09B5

Strings

ccs, xrefs: 00000001400BDBD2
UTF-8, xrefs: 00000001400BDC16
UTF-16LEUNICODE, xrefs: 00000001400BDC35

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 52d2e1ded8eb554064c4cb981e42dda595611719be45fd956e39e49f6aab8990
Instruction ID: a7380f8d91c0f51d8c5017247360c936db88b11f39ee120fc7b39bc71795c185
Opcode Fuzzy Hash: 52d2e1ded8eb554064c4cb981e42dda595611719be45fd956e39e49f6aab8990
Instruction Fuzzy Hash: 29819FB6604A01C6FB678FAB8250BF8BAB0A31DBD8F568007FB01572F5E339C9419741

Function 0000000140046090 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140046100
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000140046148
_Getcoll.LIBCPMT ref: 000000014004617C

Strings

bad locale name, xrefs: 0000000140046281

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1287851536-1405518554
Opcode ID: 506707e2d240d4ab0b537c69dfcf1fb6c5038538439ce55b666aef880623bdb8
Instruction ID: 489c8c2ba9abbea0c29969b52741dad31773e5bb770f95e1fec64f7120da926a
Opcode Fuzzy Hash: 506707e2d240d4ab0b537c69dfcf1fb6c5038538439ce55b666aef880623bdb8
Instruction Fuzzy Hash: A3718E32B02B408AFB12DFB6D4513DC3372EB49798F044525EF5927AAADE38C455C388

Function 0000000140059950 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 0000000140059B30
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140059B3D

Strings

, column , xrefs: 0000000140059A08
at line , xrefs: 00000001400599DA

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: __std_exception_destroy
String ID: at line $, column
API String ID: 2453523683-191570568
Opcode ID: 875daaafa384ddb290e5272c42d1ea0d07dec2c117082f6cf2be1406e08a2c5a
Instruction ID: 5207224b8eb66a8d2bcd0b877e44d41c590973a9f0545e09de86757c3ae7f246
Opcode Fuzzy Hash: 875daaafa384ddb290e5272c42d1ea0d07dec2c117082f6cf2be1406e08a2c5a
Instruction Fuzzy Hash: 0D51BF72604B8081EB11DF5BE1803AEB761F789BD4F144212FBA907BAADF79C591C740

Function 00000001400B90DC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000001400B90F2
GetProcAddress.KERNEL32 ref: 00000001400B9102

Strings

kernel32.dll, xrefs: 00000001400B90EB
GetTempPath2W, xrefs: 00000001400B90F8

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: 3a88399276a8991c765a238947144622f033e298172f0102f8c10e8fe062d9c5
Instruction ID: 314276daedbd8c3379550707c53152423bdaefd57b6adaad12429f531f7f3858
Opcode Fuzzy Hash: 3a88399276a8991c765a238947144622f033e298172f0102f8c10e8fe062d9c5
Instruction Fuzzy Hash: 7EE0E531310A8582EF469F12F9897AD2321BF9CBC5F885025EA5E47334DF38C48A8710

Function 00000001400A2128 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000001400A224B
GetLastError.KERNEL32 ref: 00000001400A22D5

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: eff3b50df2d8f10e201eca562cd76daf8c611fc7857359750e57e40757c68bca
Instruction ID: 7d4959ebbf95b692b16abb74eac4d8459f638893447112031ddcf34af14a6c4b
Opcode Fuzzy Hash: eff3b50df2d8f10e201eca562cd76daf8c611fc7857359750e57e40757c68bca
Instruction Fuzzy Hash: B291B47271065099FB52CB6B98807ED27A0F36DBD8F444225FF4A57AA4CB38C4C6CB10

Function 00000001400B9064 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

SetFileInformationByHandle.KERNEL32 ref: 00000001400B9084
GetLastError.KERNEL32 ref: 00000001400B908E
SetFileInformationByHandle.KERNEL32 ref: 00000001400B90C1
GetLastError.KERNEL32 ref: 00000001400B90CB

Memory Dump Source

Source File: 00000001.00000002.2202892025.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_RUN.jbxd

Similarity

API ID: ErrorFileHandleInformationLast
String ID:
API String ID: 275135790-0
Opcode ID: 81d10114c1786b400c54503466fc6a69753620fc9a5ac361ab1bea0ddac7e0e2
Instruction ID: f2b0abd9e6732770bfeb8fa7b7e27c8ccc6d5150b355bc4a45e5b52231632814
Opcode Fuzzy Hash: 81d10114c1786b400c54503466fc6a69753620fc9a5ac361ab1bea0ddac7e0e2
Instruction Fuzzy Hash: 79F0F4312209418BF7A66FE2E8543E926B0EF1D794F040024FF02435B9DB79C9858710

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. Within MFT entries are file attributes, such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RUN.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Desktop\a.exe:extractor.dll

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
RUN.exe

Function 00007FF8A8E01690 Relevance: 40.4, APIs: 19, Strings: 4, Instructions: 193
libraryloaderinjectionCOMMON

Function 00007FF66B1225D1 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 345
stringnativeCOMMON

Function 00007FF66B121180 Relevance: 12.2, APIs: 8, Instructions: 191
sleepstringCOMMON

Function 00007FF66B123590 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134
stringnativeCOMMON

Function 00007FF8A8E222C0 Relevance: 22.9, APIs: 3, Strings: 10, Instructions: 120
stringCOMMON

Function 00007FF66B15D9C0 Relevance: 22.9, APIs: 3, Strings: 10, Instructions: 120
stringCOMMON

Function 00007FF8A8E011D0 Relevance: 7.7, APIs: 5, Instructions: 164
sleepCOMMON

Function 00007FF8A8E21C20 Relevance: 2.6, APIs: 2, Instructions: 78
COMMON

Function 00007FF66B15CDA0 Relevance: 2.6, APIs: 2, Instructions: 78
COMMON

Function 00007FF8A8E183A0 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Function 00007FF66B13B930 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Function 00007FF8A8E1F7B0 Relevance: 1.3, APIs: 1, Instructions: 34
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre